I've got Error in 'stats' command: The argument 'operation' is invalid. But, after research on your answers I figured out correct command exactly what do I need! It's: | stats values(gid) by operation ... View more

You'd need a second transform after (as part of the [nyc] sourcetype) to subsequently null queue the local event, after forwarding a copy to syslog. ... View more

As an alternative, there is now a Splunk app called PyDen that allows you to use multiple Python versions, virtual environments, and PyPI packages. This means you could create a virtual environment of any version you want and install the Splunk SDK to it, and that environment can be used by any script in any app with the right import statement. ... View more