I am basically faced with this problem:     | makeresults count=3 | streamstats count | eval a.1 = case(count=1, 1, count=2, null(), count=3, "null") | eval a.2 = case(count=1, "null", count=2, 2, count=3, null()) | eval a3 = case(count=1, null(), count=2, "null", count=3, 3) | table a* | foreach mode=multifield * [eval <<FIELD>>=if(<<FIELD>>="null",null(),'<<FIELD>>')]     I have fields that contain a `.`. This screws up the `foreach` command. Is there a way to work around this? I have tried using `"<<FIELD>>"` but to no avail.  I think it would work to rename all "bad" names, loop trough them and rename them back, but if possible I would like to avoid doing this.       ... View more

I basically have the opposite question as can be seen here: https://community.splunk.com/t5/Splunk-Search/How-to-use-the-head-command-with-group-by/m-p/444439 I am looking for an increase in performance while keeping the search generic. As a minimal example I created this:     | makeresults | eval data=split("1;1,1;2,2;1,2;2",",") | mvexpand data | eval data=split(data,";") | eval a=mvindex(data,0), b=mvindex(data,1) | table a b | dedup a     I know that I can tremendously speed up the search if I use a template like so, using "| head 1" on each group of a:     | makeresults | append [| makeresults | eval data=split("1;1,1;2,2;1,2;2",",") | mvexpand data | eval data=split(data,";") | eval a=mvindex(data,0), b=mvindex(data,1) | table a b | search a=1 | head 1 ] | append [| makeresults | eval data=split("1;1,1;2,2;1,2;2",",") | mvexpand data | eval data=split(data,";") | eval a=mvindex(data,0), b=mvindex(data,1) | table a b | search a=2 | head 1 ] | search a=* | table a b     However, this way the search is no longer generic and I have to know what groups "a" can take (1,2 in this example) Question: Is there a way to increase performance on dedup while also keeping the search generic? ... View more

I am running a search in JavaScript that returns results similar to this one.   new SearchManager({ id: "my_search", results: true, search: ` | makeresults count=10 | streamstats count | fields - _time ` });   What I would like to obtain is a JS array with the resulting vector in a variable. I tried to solve it like so:   let search = mvc.Components.get("my_search"); let results = search.data("results"); results_outside = results.on("data", function(){ // 1b) let rows = results.data().rows; let array = rows.flat(1); // I want the flattened array, no nested one console.log("array: ", array); tokens.set("arrays", array); // 2) return array; // 1a) }); console.log("results_outside: ", results_outside);    The `array` variable within the function has the desired results, as I can tell from the console. However exporting it to the global scope neighter works by:   1) storing it in `results_outside` - this will have the same value as results.   or   2) setting it to a token. ... View more