Hello there! I'm trying to use <change> and <eval> inside of my time input to create a token that takes in $time.earliest$ and converts it to a unix timestamp, however, my <eval> is not working how I expect. When I use $start_time$ in my dashboard panels, I get a literal copy/paste of the "relative_time(now() ..." statement (i.e., it's not actually evaluating).  I've seen multiple examples in Splunk documentation and it seems like <eval> is supposed to evaluate the function you're trying to use. Help me, Splunk Community.  You're my only hope. ... View more

Hello there! I'm trying to ingest JSON data via the Splunk Add-on for Microsoft Cloud Services app.  I created a sourcetype with INDEXED_EXTRACTIONS=json and left all other settings to their default values.  The data got ingested, however, when I table my events I start seeing mv fields with duplicate data.  I'm even seeing the "Interesting Fields" section add up to 200% (instead of the expected 100%). Sourcetype settings   Interesting Fields   MV Fields with duplicate data   https://community.splunk.com/t5/All-Apps-and-Add-ons/JSON-format-Duplicate-value-in-field/m-p/306811 I then followed the advice given in this post ^^^ (i.e., setting KV_MODE=none, AUTO_KV_JSON=false, etc.) but the issue persists. I have attached screenshots to this post to better understand my situation.  I'm currently on Splunk Cloud. Any help with this is greatly appreciated ... View more

Hello there! I've been ingesting data from Azure Storage Explorer via the Splunk Add-On for Microsoft Cloud Services app, however, I now wish to ingest data from an Azure Event Hub.  I know I can either create an input in the same app or use the Microsoft Azure Add-on for Splunk app.  Is there a way to specify which partition to collect data from?  Furthermore, is there a way to send data to different indexes and sourcetypes from 1 Event Hub? I'm working on Splunk Cloud, so I currently don't have access to config files. Thanks in advance! ... View more