Hey @markhvesta  This is because Splunk Connect for Kubernetes sends data using the HTTP Event Collector ("HEC") Event  endpoint and events that come through "HEC" event endpoint do not hit the line merge processor. For more info, the events are sent like this to automate extraction of key Kubernetes metadata for you.  To deal with multiline events, the line merge must be done ahead of time in the logging collector config: https://github.com/splunk/splunk-connect-for-kubernetes/blob/09cb0462a624d348aa6bc94c0996599907de88f7/helm-chart/splunk-connect-for-kubernetes/values.yaml#L217-L285 Like this example that I applied to the Connect for Kubernetes logging pod:   logs: sck: from: pod: sck-splunk-kubernetes- container: splunk-fluentd-k8s- multiline: firstline: /^\d{4}-\d{2}-\d{2}\s\d{2}\:\d{2}\:\d{2}\s\+\d{4}\s\[\w+\]\:/ separator: "\n"    This is done with the fluentd "concat" filter that we ship in Splunk Connect for Kubernetes.  Be sure to use rubular.com to test your regex as Fluentd uses ruby regex.  Similar option is available in our OpenTelemetry collector, which you may also want to get familiar with in the future as it is a more performant option for k8s log collection if you need high velocity logging as your clusters get bigger and bigger.  https://github.com/signalfx/splunk-otel-collector-chart/blob/26e37677a947d7081d686d2b7533057196bba070/helm-charts/splunk-otel-collector/values.yaml#L369-L399   ... View more

When you install a new indexer, you have to run a configuration at search head to make the indexer available to searching. Following the steps below: Log into Splunk Web on the search head and click Settings at the top of the page. Click Distributed search in the Distributed Environment area. Click Search peers. On the Search peers page, select New. Specify the search peer, along with any authentication settings. Note: You must precede the search peer's host name or IP address with the URI scheme, either "http" or "https". Click Save. Repeat for each of the search head's search peers. For further information, check this document https://docs.splunk.com/Documentation/Splunk/8.0.0/DistSearch/Configuredistributedsearch ... View more

Like this: index="AandB" AND (sourcetype="sourcetypeA OR sourcetype="sourcetypeB") AND fieldinsourcetypeAndB="*" | fields [only fields that we care about in A and B] | stats values(*) AS * BY fieldinsourcetypeAndB | lookup sourcetypeC.csv fieldinC AS fieldinA ... View more

Never use the BREAK_* options; always use LINE_BREAKER like this (you must have a capture group 😞 props.conf (on your Indexers/HFs): SHOULD_LINEMERGE = false LINE_BREAKER = <\/result>([\r\n\s]*)<result\s+expand ... View more