hi, please i would like to ask for help to determine how to convert the timezone of events i am indexing with the gcp cloud plattform add-on before they are indexed. Events arrive today in UTC, and I need to convert that time to gmt-4. I have been trying from the sourcetype configuration, without success. I was also seeing this link, without much success https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Applytimezoneoffsetstotimestamps ... View more

hello, as of today I am looking for a little help to efficiently detect when an alert stops reporting. My idea is not to generate an alert that monitors the alert (redundant) when the result or count at a certain time is zero, rather I am a more automated mechanism that helps me, maybe some app or advice that can help me detect when this happens . Thanks ... View more

Hi, I would like to know if there is some way to create a query where I can get more than 10.000 results when I used the join command.  Into the limits.conf file, I can´t edit the limit for more than 10.500 results.  Do you know some way to do this  ?, at today I have a file with more than 700.000 entries.  ... View more