Hello Friends, In a sourcetype , data are coming in from multiple hosts and host are residing in diff-2 time zones. In raw logs we can see time zone is also mentioned, I want to write a generic TIME_FORMAT for this. time stamps example : Mar 7 09:18:00 SGT: Mar 6 19:07:42 UTC: Mar 7 01:31:58.460 WST: Mar 7 09:13:17.384:   I tried like TIME_FORMAT= %b %d %H:%M:%S.%Q %Z , WHICH IS NOT WORKING. %Z is not able to recognize time zone here , please help me with some other expression.   Thanks in advance 🙂 Happy Splunking !  ! ... View more

Hi Friends,   I am trying to list out all the available splunk lookups and want to display count of records present in each lookups. However i found rest command to list out all the lookups but how to get count of records for each lookup ? Rest command :  | rest/servicesNS/-/-/data/lookup-table-files |table title  I want to display count of records present in each lookup in another column. Is it possible to display with SPL? Requesting your valuable feedback and help. Thank you in advance. Himanshu     ... View more