I am also looking for a way to do this. Depends on what you need and what you want to do, but a way to access them would be using Entity and Collections classes. DATAMODEL_ENDPOINT = 'datamodel/model' datamodels = Collection(self.service_wrapper.service, DATAMODEL_ENDPOINT) for datamodel in datamodels: // do stuff ... View more

Bang on! Our deployment template was adding a time retention of 14 days by default in etc/system/local/indexes.con that I overlooked. The indextest script is completing now. Thanks guys. ... View more

I believe the best way would be to use calculated fields - http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields In props.conf, you could set up a calculated field such as: [<stanza>] EVAL-<field_name> = <eval statement> which in your case: [<your_stanza>] EVAL-someResult = token1 * token2 * <someConstant> ... View more

I understand that another key benefit is the acceleration. Has anyone done any comparative performance test? ... View more

From the error it seems like there was something wrong with indexing test; either the indexing test result was not generated correctly/not there, or corrupted? Check if bin/indexRecord.log is correctly written. ... View more