Is there a suggested size of lookup that would be the maximum size of a lookup that should be used for an automatic lookup? Such as if your lookup exceeds more than x rows it would best not to use with an automatic lookup?     ... View more

Example of issue encountering: Search one returns a row with all the fields populated | makeresults count=1 | eval tmp_field1="abc" | lookup kvstore_name field1 AS tmp_field1   Search two returns a row with most of the fields empty (even though it is a search of the same row in the kvstore - just using a different field) | makeresults count=1 | eval tmp_field2="xyz" | lookup kvstore_name field2 AS tmp_field2 What could cause the results described above? (any recommendations would be greatly appreciated)     ... View more

If you have a dashboard that has a panel with a  search like the one below: | rest splunk_server=* /services/-/-/admin/......../appName/local | table name splunk_server title How can you make it so that it searches the other search heads? (a search like the one above returns values for the current search head and its peers - indexers)    ... View more

What is the best way (globally for all apps) to detect and report on either the creation of a new file in a /appname/local/ directory of an app OR when a file has been updated within a local directory of an app.  Thanks! ... View more

Is there a more secure way to make client connection to splunk other than username and password (in conf file)? (such as system account using certificate?) ... View more