I don't like that this add-on is using INDEXED_EXTRACTIONS by default, with no seemingly easy way to switch from using them with the way that the scripted input works... Hopefully this will be improved now that Cisco owns Splunk... ... View more

You can raise a case with Cloud support. ... View more

You can split it into 2 commands to make it work: ... | eval output=mvappend(field_1, field_2) | stats values(output) as output ... View more