I have encountered an issue with the foreach command on mv-fields. When I execute my search, Splunk says: "Error in 'eval' command: The expression is malformed. An unexpected character is reached at '<<ITEM>>'. " SPL to reproduce:     | makeresults | eval mvfield=mvappend("1", "2", "3"), total=0 | foreach mode=multivalue mvfield [eval total = total + <<ITEM>>] | table mvfield, total     Note: this query is directly pulled from the examples for the foreach command. Note2: the argument "mode" is not syntax-highlighted (would expect green) ... View more

Data Model (simplified): - numeric value "Hours" - numeric value "StartTime" (assumed to always have time be 00:00:00) in UnixTime - numeric value "EndTime" (same assumptionm as above) in UnixTime - calculated from the above two: time period as UnixTime value - calculated: "Hours" per day - string value (cathegorical) "Group"   Goal: get a List of Days where each day contains: - the respective date - the "Hours per Day" value assigned to a field named after the Group   Intention: create a vizualisation showing what group is needed how much at what time ... View more

When using the DLTK, I get a lot of different error messages rather frequently, the most often occurring being:"Could not parse xml reply (no reply from script). See splunkd.log for more info.." with "02-25-2022 11:21:05.426 +0100 WARN HttpListener [16744 HttpDedicatedIoThread-7] - Socket error from 127.0.0.1:60124 while accessing /services/mltk-container/sync: Winsock error 10053" as the corresponding entry in the log file. The state of the DLTK on my machine is, that a connection with Docker has been successfully established, but no containers are found in the containers context menu except for the __dev__ container, which cant be started. I have pulled some of the images from dockerhub as described in the setup guide for air gapped environments, even though mine is not. These are not found by Splunk. Has anyone got any idea of what I might be doing wrong, I have tried to follow the setup guide as closely as possible without success. Thanks in advance ... View more