No, I'm using #python3 myscript.py running #/opt/splunk/bin/python3.7 myscript.py doesn't work     ... View more

I have the same problem. I've just done this change in log.conf "category.TransformsExtractionHandler=ERROR", but issue is still alive. Any other workaround? ... View more

It doesn't work. First error on info_max_time Second error on append: I cannot use two subsearches after append command. Any advice is welcome Thank you AF ... View more

Hi, example with real time specification: index="index1" sourcetype="sourcetype1" publicip="'x.x.x.x'" freed earliest="1/20/2014:12:48:00" latest="1/23/2014:12:48:00" | append [search index="index1" sourcetype="sourcetype1" publicip="'x.x.x.x'" assigned earliest="1/17/2014:11:48:00" latest="01/20/2014:11:48:00"] | transaction framed_ip_address, publicportrange startswith=assigned endswith=freed | search index="index1" sourcetype="sourcetype1" | table username, acct_session_id, acct_unique_id, acct_start_time, acct_stop_time I tried: [search index=index1 | addinfo | head 1 | eval earliest=$field1.earliest$ | eval latest=$field1.earliest$+259200 | fields earliest,latest | format "(" "(" "" ")" "OR" ")" ] index="index1" sourcetype="sourcetype1" publicip="'$ip$'" freed | append [ [search index=index1 | addinfo | head 1 | eval earliest=$field1.earliest$-259200 |eval latest=$field1.latest$ | fields earliest,latest | format "(" "(" "" ")" "OR" ")" ] search index="index1" sourcetype="sourcetype1" publicip="'$ip$'" assigned ] | transaction framed_ip_address, publicportrange startswith=assigned endswith=freed | search index="index1" sourcetype="sourcetype1" | table username, acct_session_id, acct_unique_id, acct_start_time, acct_stop_time with last search I got error on second "head 1". Thank you Antonio ... View more