Hello Experts! This is questoin about queue type FIFO in SQS based S3 ( Splunk add-on for AWS ). - Is there a setting that must be enabled on Splunk addon for AWS when using SQS based S3 with queue type as FIFO? - Does  addon for AWS automatically recognize the queue type? Also I know that if we use FIFO in SQS, we cannot use event notification (SNS) from S3 to SQS. Does it mean Splunk only support S3 -> SNS -> SQS(Standard queue)? I just want to know how to use FIFO queue in add-on for AWS. Thanks in advance!! ... View more

Hi Splunk experts!! Please tell me about how to bring the deepest data in multiple subsearches. Of course, if there is another way to do it than subsearch, we can use that method as well. I understand that when using multiple subsearches, each subsearch is just passing field results to the top subsearch. But can the data of any field in the first subsearch also be passed to the next subsearch? (same for the second to third subsearch) I am thinking that this is difficult with subsearch because subsearch just passes fields in AND. I believe it can be done with join or stats. But how should I do it?   index=cmdb sourcetype=crm host="fwd-splunk-fwd01a" LogicalName="new_contract" (Attributes.KeyValuePairOfstringanyType{}.new_item_name="DC_Connection" OR Attributes.KeyValuePairOfstringanyType{}.new_circuit.Name="*DC*") [| search index=cmdb sourcetype=crm host="fwd-splunk-fwd01a" LogicalName="new_circuit" FormattedValues.KeyValuePairOfstringstring{}.statecode="active" FormattedValues.KeyValuePairOfstringstring{}.statuscode="active" FormattedValues.KeyValuePairOfstringstring{}.new_circuit_status="contracted" [| search index=cmdb sourcetype=crm host="fwd-splunk-fwd01a" LogicalName="new_circuit_authority" FormattedValues.KeyValuePairOfstringstring{}.statecode="active" FormattedValues.KeyValuePairOfstringstring{}.statuscode="active" FormattedValues.KeyValuePairOfstringstring{}.new_trouble_mail_receive_flag="yes" FormattedValues.KeyValuePairOfstringstring{}.new_valid_flag="yes" [| search index=cmdb sourcetype=crm host="fwd-splunk-fwd01a" LogicalName="new_contactpoint" FormattedValues.KeyValuePairOfstringstring{}.statecode="active" FormattedValues.KeyValuePairOfstringstring{}.statuscode="active" Attributes.KeyValuePairOfstringanyType{}.new_cp_code="CP30058460" | fields Attributes.KeyValuePairOfstringanyType{}.new_contactpointid | stats latest(*) AS * by Attributes.KeyValuePairOfstringanyType{}.new_contactpointid | rename Attributes.KeyValuePairOfstringanyType{}.new_contactpointid AS Attributes.KeyValuePairOfstringanyType{}.new_contactpoint.Id | format ] | fields Attributes.KeyValuePairOfstringanyType{}.new_circuit.Name | stats latest by Attributes.KeyValuePairOfstringanyType{}.new_circuit.Name | rename Attributes.KeyValuePairOfstringanyType{}.new_circuit.Name AS Attributes.KeyValuePairOfstringanyType{}.new_circuit_code | format ] | stats latest by Attributes.KeyValuePairOfstringanyType{}.new_circuit_code | fields Attributes.KeyValuePairOfstringanyType{}.new_circuit_code | rename Attributes.KeyValuePairOfstringanyType{}.new_circuit_code AS Attributes.KeyValuePairOfstringanyType{}.new_circuit.Name ] | fields Attributes.KeyValuePairOfstringanyType{}.new_circuit.Id | stats latest by Attributes.KeyValuePairOfstringanyType{}.new_circuit.Id     ... View more