This didn't work for me. In fact, I didn't even have an action.email.format line, and couldn't find it in the docs. What version are you running? And would you mind sharing your search and the rest of that alert's configs? ... View more

Why do you want to avoid using dedup? Dedup is by far the easiest way of doing this. Just |dedup host, source, sourcetype, Date, Name | , and that's all you need to do. Add that before the transaction. Dedup will leave you with the most recent result from each duplicate set. From the docs: "Events returned by dedup will be the first event found in search order, which is the most recent for historical search" ... View more

Short answer: yes. But technically what you're describing would be called a heavy forwarder, not an indexer. Just set it up to forward to the indexers, set it to either keep a copy of indexed data or not depending on your preferences and use case (store and forward), and point all your local forwarders at it. The problem here is that Splunk isn't going to compress the data until it writes it to disk, and so you'll be sending uncompressed data along with extra metadata from the extra queues the heavy forwarder will send the data through. Unless you want that server there as a type of gatekeeper or fallback in case of network problems, it may be easier to just point all of your forwarders at your main cluster. ... View more

Look into the outlier command. http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Outlier ... View more

Try using a case statement instead of all those ifs. ... View more

Use eventstats instead of stats. ... View more

The top answer in this thread worked for me. http://answers.splunk.com/answers/49394/merge-two-fields-into-one-field ... View more