Wow, thanks for this thread. I didn't even think about splitting events within events. I'm still trying to figure out the Splunk search language, and I don't always get what I want the first time. I hope I won't bother anyone with my comment if I use it to "bookmark" the topic 🙂 I prefer to appear in all thematic forums and ask thousands of stupid questions to everyone. This is how I prevent possible errors, and it's better than carrying the hard drive to the file recovery procedure later due to a series of wrong actions. ... View more

Wow, thanks for this thread. I didn't even think about splitting events within events. I'm still trying to figure out the Splunk search language, and I don't always get what I want the first time. I hope I won't bother anyone with my comment if I use it to "bookmark" the topic 🙂 ... View more