Have you look this https://community.splunk.com/t5/Monitoring-Splunk/Received-metadata-string-exceeding-maxLength-warning/m-p/583554 ? I agree with @somesoni2  that using so long field as indexed is probably not the best idea. ... View more

Hi @ITWhisperer  Thank you for your answer. Yes, although my max_count was clearly a number, the conversion was still needed. I modified the code a bit and now it seems to work fine: <eval token="max_y_version1">tonumber($result.max_count$)</eval> <eval token="max_y_version">max(tonumber($result.max_count$), $max_y_version2$, $max_y_version3$)</eval> ... View more

Same here, have you figured it out, maybe? ... View more