I have the below configuration in my logback.xml. While the url, token, index sourcetype and disableCertificateValidation fields are getting picked up, the batchInterval, batchCount and sendMode are not. I ran my application in debug mode, and I did see that the `ch.qos.logback.core.model.processor.AppenderModelHandler` is picking up the these tags as submodels correctly. Can someone please help me understand if I'm doing anything wrong here? <?xml version="1.0" encoding="UTF-8"?> <configuration> <appender name="SPLUNK_HTTP" class="com.splunk.logging.HttpEventCollectorLogbackAppender"> <url>my-splunk-url</url> <token>my-splunk-token</token> <index>my-index</index> <sourcetype>${USER}_local</sourcetype> <disableCertificateValidation>true</disableCertificateValidation> <batchInterval>1</batchInterval> <batchCount>1000</batchCount> <sendMode>parallel</sendMode> <retriesOnError>1</retriesOnError> <layout class="my-layout-class"> <!-- some custom layout configs --> </layout> </appender> <logger name="com.myapplication" level="DEBUG" additivity="false"> <appender-ref ref="SPLUNK_HTTP"/> </logger> <root level="DEBUG"> <appender-ref ref="SPLUNK_HTTP"/> </root> </configuration>   I'm using the following dependency for splunk, if it matters -  <dependency> <groupId>com.splunk.logging</groupId> <artifactId>splunk-library-javalogging</artifactId> <version>1.11.7</version> </dependency>     ... View more

My application is a backend web service. All events in a request contain the same value for a "req_id" field. I have a use-case, where I want to look at all the events that occurred for requests, only when a particular log line is present. My first query would be this -   index="myapp" AND "some log line" | rex field=_raw "req_id=(?<req_id>[a-zA-Z0-9]*)"   And then my second query would be -   index="myapp" AND "$req_id" | transaction req_id   where the $req_id would be fed in by the first query. How do I join these two queries?  Thanks in advance! ... View more