Answer is Ctrl + Shift + F That will make your SPL neat and clean! ... View more

This should work! Thank you very much! ... View more

There are some PostProcess docs here: http://docs.splunk.com/Documentation/Splunk/6.0/AdvancedDev/PostProcess ... View more

Thank you very much! That was it! ... View more

Nope - I was told its not possible. Only way to do it would be to get the forwarder to grab the host name and send it across as part of the event. Didn't end up doing it that way though. ... View more

Not hashing per say , but this link might point you in right direction : http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Anonymizedatausingconfigurationfiles ... View more

I'm trying to do exactly the same thing, but no matter what the value of the Event field, the new field evaluates to the value of MedRepoCloneMergeTimemin and not "na" as expected. | eval newfield=if(in(Event,"mock"), "na", MedRepoCloneMergeTimemin) | eval newfield=if(Event == mock, "na", MedRepoCloneMergeTimemin) What am I missing? thanks for any ideas. ... View more