Hello Everyone I need to export the search results to a folder outside the Splunk. To do this job we've exportresults in Splunk which works fine. Basically in my scenario, it is a saved search which runs every week and data has been exported to the folder but it creates a new folder. I need to append the search results to the existing file or else I need to replace the file with the new data.  If I get result for any one of the things mentioned above. I'm good. Thanks. ... View more

Hello I have an alert that runs every 2 minutes for the last 40 hours of data. I use five different logs to retrieve the result I need using the join command. The throttle is set on, suppressing the results for 40 hours in order to suppress the repeating alert. My alert runs perfectly and triggers on time. But every three to four months once, I get the delayed alert for some hours. This issue was repeating for every three to four months, So I had an alternative alert running. Now one of the alert gets delayed for 4 hours and an other one was on time. It makes the alert less reliable. I started to monitor the triggered alerts in Triggered alerts section. Note: It's a very big query takes 30 seconds.  May I know the possible reason for this and best practices to avoid this error in future? How to identify the issue?  ... View more