Hi Zubair,   Try something like this: [YOUR_SOURCETYPE] SHOULD_LINEMERGE=true LINE_BREAKER=(, ) TRUNCATE=9999999 BREAK_ONLY_BEFORE={ MUST_BREAK_AFTER=} SEDCMD-cleanup-before=s/^\{ "User" : \[\s\{/{/g SEDCMD-cleanup-after-2=s/\s\[\}/}/g It's best if you can run that on a test instance first with some sample data to see how it works for you.   ... View more

Hi @splunk_noob2022 ,   If an indexer has just gone into detention then most likely the "RF/SF not met" issue is linked to the CM trying to rebuild the buckets lost along with that indexer. The parameters you posted are simply tuning for the indexes configuration and shouldn't have any effect on RF/SF being met. Could you please check in your internal logs for the indexer that is in delention to see what other issues could be causing this? Cheers, David   ... View more

Hi @splunk_noob2022 , In terms of "when to restart" Splunk, please have a look at the following docs link: https://docs.splunk.com/Documentation/Splunk/9.0.2/Admin/Configurationfilechangesthatrequirerestart#When_to_restart_splunkd  When you make changes to various config files, refer to the link above to confirm whether a restart is needed. Eventually, you'll memorize what needs restarts and what doesn't. For search time extractions, there's not need to deploy the configs on the indexers since the search heads already share those configs in the knowledge bundle. So search time extractions should go on search heads only. For index-time extractions, deploy them on all "indexer" nodes that the data traverses. Since HFs cook (process) the data, you will need to have the TAs on any HF that the data uses. If you're unsure of the data path, it's best to have the index time TAs on HFs and IDXs. I hope this helps! Cheers, David         ... View more

Oh okay, in that case, go under : Settings > Searches, reports, and alerts You should be able to see your saved search there and delete it.   ... View more