I have two variables and based on one would like to possible change the value of the other: .. | eval a="foo" | eval b="some value" | eval a=if(match(b, "kittens"), "bar", a) So if b contains 'kittens' make a's value equal 'bar', otherwise keep it 'foo'. Is this possible? As it stands now a only ever has a value when b contains 'kittens'. Thanks, Kevin ... View more

We're using Splunk on a network that is cordoned off from the interwebs. Is there a way that we could either disable or change the url that the ?Help link points to for all apps? Thanks, Kevin ... View more

When using a lightweight-forwarder we were able to clean the fishbucket (eventdata) so that we could re-forward data. Trying this on the new universal forwarder yields the message "ERROR: Cleaning eventdata is not supported on this version." Is there a new way to do this? Thanks, Kevin ... View more

We used to have a dashboard driven by a simple query that would show a value per hour for all of our index servers. * | timechart span=1h count by splunk_server useother=f Before we upgraded to 4.2 this would work as we had come to expect it, but now it only shows the top 10 servers. If we drop useother=f it will then show an "other" column along with the top 10, but we want all splunk_server values. Is there a new way to do this? Thanks, Kevin ... View more

I have a large lookup full of bad domains. The lookup is simply a domain name per line. I would like to search through a section of logs and return events where the bad domain exists. My domain list looks like baddomain baddomain1.com baddomain2.com ... And the query I'm attempting to write looks like index=myindex | append [ inputlookup domains.csv | fields baddomain ] | where domain=baddomain | ... If I run just the inputlookup portion of the query I'm seeing my results, but they do not seem to be getting appended. Thanks, Kevin ... View more