is your issue resolved? Getting the same error on HF for hec tokens ... View more

After creating the /opt/splunk/etc/apps/search/README directory, I ran "cat > alert_actions.conf.spec" within the README directory.     ... View more

Hi probably you could found those by searching for _internal? I haven’t have this kind of situation, sou I couldn’t give you a SPL for that. Another option is look your current search which has given that warning. Then just create search like <your base from previous search> |eval len =length(_raw) | fields host source sourcetype len | where len > <max length from error message> r. Ismo  ... View more