Summary: When using the table command, values are dropped if { is the first character.     index=someindex host="VVV" source=somesource earliest=-24h  action           NOT( ACTION ="SUMMARY" OR ACTION="RESULT")           | dedup ID         |rename ID as "Rcrds Prcssd To Date"           | rename EVENT_DT as "Date Time" EVENT as "API EVENT"           |convert ctime(_time) as RunDate timeformat="%m/%d/%Y %H:%M %p"           |table ID,RunDate,ACTION, "API EVENT"           |SORT -ID   When the "API EVENT" field has a { starting value, the remaining values are dropped. If I replace  |table ID,RunDate,ACTION, "API EVENT" with |fields ID,RunDate,ACTION, "API EVENT" I see the { and the remaining values for "API EVENT"   Why is the table comm, and dropping values? ... View more

Building a Dashboard dropdown. The following query works fine and there are no duplicates in the resultset however the dashboard filter has the message "Duplicates values causing conflict". When I hover over this message a pop up show the following: Error in 'dbxquery command'. This command is not supported in realtime search. the query is ... |dbxquery query="SELECT DISTINCT last_name FROM hr.employees" connection="ORCL_PDB1_CONN" Using SPLUNK DB COnnect APP In advance, thanks for you comments/insights and assistance. ... View more

Setting up SPLUNK Reciever I get the following error - Configuration for port 9997 already exists. Netstat shows that port 9997 is listening SHould I simply choose another port or is SPLUNK already using this port? (How can I check that?) ... View more