You can concatenate two fields using eval ex: eval Full_Name= 'First Name'. " " .'Last Name' ... View more

Try to do rsync from old directory to new directory, probably this will solves the issue. Example command: rsync -avzh ... View more

Hi, As per your query understood the events are more than 1000000, check the below links and Hope this helps your query! https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Limitsconf https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Savedsearchesconf#dispatch_search_options ... View more

Hi, As per your query understood that events are more than 1000000, kindly go through the below links . Hope this helps your query! https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Limitsconf https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Savedsearchesconf#dispatch_search_options ... View more