I found that I had an error in one of my correlation searches because I saw it in the cloud monitoring console. When I fixed the error I suddenly saw that the latency over this specific correlation search was >4 million seconds. Looking into the actual events that the cloud monitoring console is looking at I see scheduled_time is more than a month ago. Did I do something dumb or is Splunk actually just trying to run all those failed scheduled tasks now and I just need to wait it out? Or is there a way to stop them from running? I disabled the correlation search already and did a restart from the server controls.... ... View more

For CIM compliance I am trying to fill the action field from some logs using a case. This works in search but not in the calculated field, I see some others had similar issues but there has not been an answer on here. I am on Cloud so cannot directly change the confs, but calculated fields so far have been working fine. Simple case statements that do not have multivalue fields with objects (e.g. category instead of entitis{}.remediationStatus) work as expected in calculated fields. The events have a similar setup like this: {"entities": [{"name": "somename"}, {"name": "other naem", "remediationStatus": "Prevented"}]}   Search (WORKS):   eval action=case('entities{}.remediationStatus'=="Prevented", "blocked", 'entities{}.deliveryAction'=="Blocked", "blocked", 'entities{}.deliveryAction'=="DeliveredAsSpam", "blocked", true(), "allowed")   Calculated field (Doesn't WORK): action=case('entities{}.remediationStatus'=="Prevented", "blocked", 'entities{}.deliveryAction'=="Blocked", "blocked", 'entities{}.deliveryAction'=="DeliveredAsSpam", "blocked", true(), "allowed") ... View more

Hi all, I have events coming in that have multivalue fields, but not always the same fields are multivalue. I want all the fields in the events resulting from a search to be concatenated to single value field. Example: Result now shows: dest       xyz                 fff Result should show: dest   xyz [delimiter] fff Just to be sure that everyone understand using dest here is an example it should be a query that I can run that would actually change every multivalue field regardless of field name. Cheers, ... View more