No, not atm. ... View more

Actually that isn't complete. This would show 1234.56 as 1.234.56 when it is expected to see 1.234,56 Add an extra 2 lines to fix it. | eval count=tostring(count,"commas") | rex field=count mode=sed "s/\./#/g" | rex field=count mode=sed "s/,/./g" | rex field=count mode=sed "s/#/,/g" make it into a macro if you need it a lot. ... View more

Since 4.2, Splunk ships with an internal and hard-coded list of revoked licenses which the product will reject. This list is updated with every maintenance release. These licenses have been revoked after a customer request to split them into smaller chunks or merged into larger ones, which means that the purchased daily indexing volume associated with the revoked license has been reassigned to another license. If you are unable to figure out how the daily volume of a given revoked license was reassigned (the valid license should be visible in your splunk.com account page) or believe that your license was wrongly revoked, please open a case with Splunk support @ http://www.splunk.com/index.php/submit_issue ... View more

Note - it's a small thing but it's best to comment by clicking 'add comment' on an answer or on a question, rather than posting an answer that's really a comment. ... View more