you could set up different inputs with a relevant source type on the input field of the form.  or if you are planning to use a single input with multiple tables coming in you can set up props and transforms in the app to modify the sourcetype value based on your logs. look for an identifying field with 100% log coverage, use that in a regex to identify your records and modify the sourcetype. ... View more

@ang3loliveira - You have two options: You have a report/alert already scheduled and running and you want to export the results of last execution. Use the REST API solution as provided by @aasabatini  You have report but not schedule and running.  Use Python SDK to run and get results and then use few lines in python script to send data to where you want to. https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/ Note that you can do first REST API call also with Python-Splunk-SDK.   I hope this helps!!! Karma/upvote would be appreciated!!! ... View more

Could you please help us, giving some idea about the extraction you used to solve this issue. I am also facing the same issue here, though  we are able to fetch some data from MS Azure log analytics but data shows only header part. ... View more

At least to me, the problem is solved after I changed the redirect URI to redirectUri="https://localhost" ... View more

Hi @02sangeet, about the first error, the correct paramer is: maxTotalDatasizeMB = 1024 as you can see at https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Indexesconf About the second, I don't see any formal error, are you sure of value of 4? default is 300! check if there's a special char like tab. Ciao. Giuseppe ... View more