Though the row data has timestamp but I want to replace this timestamp with date of the filename. For example: event:20120507214400,12,10,12028593134,12038621218,10,10101,1 filename:Test_20120503_000.log I want to get "20120503" instead of "20120507214400". How can I do? Thank you very much. ... View more

Hi,In my appname/local/ dir,authorize.conf's configuration information: [default] srchDiskQuota = 20000 srchJobsQuota = 3 rtSrchJobsQuota = 6 [role_admin] srchDiskQuota = 20000 but when I run " splunk cmd python $path/fill_summary_index.py -app $app -namefile $searchfile -et $et -lt $lt -j $jobs -dedup $dedup -showprogress $showprogress -auth $auth -owner admin ",it appeared the same errors again and again. This is the error message: ERROR DispatchCommand - Your maximum disk usage quota has been reached. usage=10600MB quota=10000MB user=splunk-system-user. The search was not run. Use the [[/app/search/job_management|Job Manager]] to delete some of your saved search results. SearchId=scheduler__nobody__search_SW5kZXhpbmcgd29ya2xvYWQ_at_1341376200_0d2f591dda7709d3 . What should I do? ... View more