I have setup an episode review that is capturing alerts and generating episodes, so now I want to know if I can add comments to the Episode based on conditions, for example splunk-system-user should check if the status becomes -pending and add a comment : "The details for this are - (fieldvalue) " for example : if i have a field with name "Version" I want the system to add a comment like : "The details for this are : 1.2.3" I tried adding this in rules. But when i check the comments i see the comments like this Please let me know if you know of any way I can add a field value in the comments. Thanks in advance. ... View more

I was looking at my organizations SVC Utilization by the hour and I noticed this component under the label "process_type" with the value "Search launcher" which is consuming a huge portion of the SVCs. What exactly is this search launcher? How do I deep dive into whats running under the hood? Any tips on how to approach on reducing the svc consumed by this? ... View more

So I have a lookup file with a complete list of servers and their details like version, owner etc, and an index my_index that gets logs from servers. This is the search I am using right now | inputlookup my_lookup.csv | join type=left server_name [ | tstats count where index=my_index by host | eval reporting="yes"] | eval reporting=if(isnull(reporting),"No","Yes") I want to validate the list by referencing it against the tstats reports and show the whole list of the lookupfile. What I want to know is if this search is accurate, will the subsearch truncate results giving me inaccurate output, is there any alternate way to write this search, Please help. ... View more