you could use transaction command too, and then use eval with some MV functions. You can also propogate 1 field to multiple events using stats values(col2) as col2_distinct by col1 | mvexpand col2_distinct . stats + values = a distinct list. stats + list = a full list. ... View more

They is no documentation on the location of each search, it depends of the order. Statistical commands can run on the search-peer and be combined in the search-head. Initial rex filters can apply on the search-peers, but rex applied on result of search results will be applied on the search-head of course example : mysearch terms -> on search-peers | rex field=_raw to populate fieldA -> on search-peer | stats count latest(_raw) AS fieldB by fieldA -> apply on search-peer and is consolidated on search-head | rex field=fieldB to populate fieldC -> search-head | stats sum(fieldC ) by fieldA -> search-head The search inspector can show you how long it took per indexer, and the overall cost per search component. but not the details you are asking. ... View more

You can do this using an macro with a subsearch. If you create a search field in your subsearch it will expand out into a search, and you can use replace to format your string correctly, like so: index=_internal metrics [ stats count | eval test="per_host_thruput,per_index_thruput" | eval search = "group=" + replace(test,",", " OR group=") ] Which could be converted into a macro which specified the variable fields, and the field name. You can also do this be creating a python script that returns a field called search, and then call it inside a subsearch. ... View more

What about calling the saved search via the search command itself from the CLI? IE curl -k -u admin:changeme -d 'search="savedsearch \"Errors in the last 24 hours\""' -d "output_mode=json" -d "exec_mode=oneshot" https://localhost:8089/servicesNS/admin/search/search/jobs/export ... View more

No you cannot selectively ask splunk to monitor a part of a file, or the order of them. A) the simple solution is a dedup in the events. source=mypath/to/my/folder/* | dedup _raw see http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/dedup B ) No. the mod time of the file is not indexed. The closest you have is the _indextime (when the events is received at the indexer) A solution is to index all and to use the timestamp of the events: source=mypath/to/my/folder/* | stats latest(_raw) AS _raw by source or the indextime source=mypath/to/my/folder/* | eval oldtime=_time | eval _time=_indextime | stats latest(oldtime) AS oldtime latest(_raw) AS _raw by source C) use the _indextime for the same purpose. ... View more