I have a timechart that I want a column name to reflect a field name like how a variable or token would be used.     ```Example``` |makeresults |eval sample="100" |eval name=if(sample=100,"C",N/A) |timechart max(sample) as $name$ ```Expected Outcome would by a timechart with column named "C"```       Is this possible? ... View more

Lookup file `tenants.csv`   tenant, tenant1, tenant2, tenant3, tenant4,   Desired query   index=index1 (tenant1xxx OR tenant2xxx OR tenant3xxx OR tenant4xxx)   I'm having a tough time getting this work.  Trying lookup is not working because I am not searching any existing fields.  Subsearching with inputlookup is not working at all, not sure why. So in a nutshell, I'm trying to inject (not just each value from the lookup file but also appending `xxx`), as an OR list of raw strings.  Any ideas?   ... View more

I have a Splunk container for development (Dev).  I want to import a slice of data from one index of my production Splunk (Prod) to this container so I can write searches against that data exactly as it appears in Prod.  Using Export on Prod and Import on Dev is not producing my desired outcome.  Doing this as a single file with a single indexing is creating logs that are indexing the container hostname as the host not the host of the data itself.  The data in the Prod index is of varying sourcetypes so the import is also only creating the sourcetype of the import file, not tha sourcetype from the data itself.  I'm looking at possibly using the  EventGen app but not sure if this will do what I'm trying to do. Is what I'm doing possible?  I do not want the entire prod index. I do not want to rsync or otherwise go to the backend to move data.   EDIT: I modified the title, it seems I want the raw data and metadata to all come over in one package? ... View more