I am also looking for a way to do this.
Depends on what you need and what you want to do, but a way to access them would be using Entity and Collections classes.
DATAMODEL_ENDPOINT = 'datamodel/model'
datamodels = Collection(self.service_wrapper.service, DATAMODEL_ENDPOINT)
for datamodel in datamodels:
// do stuff
... View more
Bang on!
Our deployment template was adding a time retention of 14 days by default in etc/system/local/indexes.con that I overlooked.
The indextest script is completing now.
Thanks guys.
... View more
I believe the best way would be to use calculated fields - http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields
In props.conf, you could set up a calculated field such as:
[<stanza>]
EVAL-<field_name> = <eval statement>
which in your case:
[<your_stanza>]
EVAL-someResult = token1 * token2 * <someConstant>
... View more
From the error it seems like there was something wrong with indexing test; either the indexing test result was not generated correctly/not there, or corrupted?
Check if bin/indexRecord.log is correctly written.
... View more