@hal2004 , The error that you have mentioned indicates that the stack name is not right. Can you try to curl below URL to get the status of your stack :  https://admin.splunk.com/{stack}/adminconfig/v2/status ... View more

Only Scripted & Powershell Input has option to use Cron expression as interval. https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/Inputsconf#Scripted_Input: ... View more

Hey @hal2004 , You need to replace "important-iguana-u5q" with your Splunk Cloud Stack ID. i.e. If your Splunk Cloud URL is https://abc.splunkcloud.com then use "abc" as your Stack ID. ... View more

Hey @nags ,   Try this : https://docs.splunk.com/Documentation/Splunk/9.1.0/DistSearch/Distributedsearchgroups ... View more

Hey @SplunkExplorer , Small correction. The eventcodes need to be comma separated. Thank you for accepting the answer. [WinEventLog://Security] ... <other parameter> ... whitelist = 4624,4625 ... View more

AFAIK, There is no limitation. It might take some time if there are a lot of records in kvstore but no limitations. https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchReference/Lookup ... View more

source="testing.csv" host="so1" index="test_csv" sourcetype="test_csv" | rex "(?<Test_ID>\d+),(?<name>.*)" max_match=0 | table Test_ID,name   1. source="testing.csv" host="so1" index="test_csv" sourcetype="test_csv" - This is just searching for a particular index, source, sourcetype. 2. | rex "(?<Test_ID>\d+),(?<name>.*)" max_match=0 -  rex - It extracts fields inline from the events. The field extraction is not permanent. https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchReference/Rex "(?<Test_ID>\d+),(?<name>.*)" - It is regular expression as per my sample data. Try https://regex101.com/ for building the regex as per your data. max_match=0 - It will allow rex command to match all matching field-values. Otherwise rex will only match the first occurrence. ... View more

Hi JGP, You can create your own custom sourcetype to parse the events separately. Let me give you an example :  My Sample Data -  Test ID,name 1,test1 2,test2 Test ID,name 3,test3 4,test4 Test ID,name 5,test5 6,test6 My Sourcetype configuration -  [test_csv] LINE_BREAKER=(\n+)Test SHOULD_LINEMERGE=true NOTE - You can define the other parameters as per your need. This is how it parses the data :  If you want to extract fields, You can write your own REGEX to do it. Here is how I did it using "REX" command. Just to showcase :  The query :  source="testing.csv" host="so1" index="test_csv" sourcetype="test_csv" | rex "(?<Test_ID>\d+),(?<name>.*)" max_match=0 | table Test_ID,name Hope this helps. Thanks. ... View more