Again excellent example how you can solve issue with different ways in Splunk 😉 You should accept one of those to help other community users to see that there is accepted solution for this question! Happy Splunking! ... View more

Hi @alexeysharkov, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Thanks Kamlesh! props.conf was empty 😞 And now [mymonitorinf] CHARSET=UTF-8 INDEXED_EXTRACTIONS=json KV_MODE=none SHOULD_LINEMERGE=true category=Structured description=JavaScript Object Notation format. For more information, visit http://json.org/ disabled=false pulldown_type=true Everything OK now! Thanks ... View more

SPL is not SQL - SPL works on a pipeline of events being processed and passed on to the next step in the process. If it helps, think of it like a bash script cat file | grep "value" | sort Each command passes the results through stdout to the stdin of the next command and only the data in that stdout/stdin pipe gets passed ... View more