i think it really depends on your use case. typically i would prefer to use the native splunk scheduling, but 150+ near identical reports reports being run on the first of each month, interfering with interactive splunk users, and occasionally exhausting cluster resources was not ideal.  im using a scheduled ci-cd process that executes this job in a docker container. ... View more

Hi @tam82 and @splunknewbie, as you can read at https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Inputsconf, it's possible to assign a field value using _meta, but why do you want to do this? Ciao. Giuseppe ... View more

does anyone have an idea ? ... View more