The filmed version of each story contains 1000s of details apparent to us, but clearly never observed directly by the narrator. Yet it’s still the narrator who’s – ostensibly – telling us the story… ? https://t.co/NwC9S3h6LS https://t.co/SQxZnUhclN

The filmed version of each story contains 1000s of details apparent to us, but clearly never observed directly by the narrator. Yet it’s still the narrator who’s – ostensibly – telling us the story… ?https://t.co/NwC9S3h6LS pic.twitter.com/SQxZnUhclN — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 11:25AM via IFTTT

Looking forward to ”5 Tips to Faster Support Case Resolution” at #splunkconf19 Thursday Especially to see if they’re even close to inline with *THE* guide to effective support cases – https://t.co/xfsCOvbMnM

Looking forward to ”5 Tips to Faster Support Case Resolution” at #splunkconf19 Thursday Especially to see if they're even close to inline with *THE* guide to effective support cases – https://t.co/xfsCOvbMnM — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:21AM via IFTTT

#splunkconf19, in combination with several customer engagements, has given me several #RFE ideas (which I’m tweeting as I get them formalozed in my head) And possible use-cases/new apps

#splunkconf19, in combination with several customer engagements, has given me several #RFE ideas (which I'm tweeting as I get them formalozed in my head) And possible use-cases/new apps — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:15AM via IFTTT

RFE @splunk: a built-in report that shows all scheduled searches (searches, reports, dashboards, alerts, etc) sending to an invalid email address (ie one that bounces/returns as unreachable)

RFE @splunk: a built-in report that shows all scheduled searches (searches, reports, dashboards, alerts, etc) sending to an invalid email address (ie one that bounces/returns as unreachable) — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:13AM via IFTTT

RFE @splunk: a built-in report that shows all schedules searches (searches, reports, dashboards, alerts, etc) no longer associated with an active user

RFE @splunk: a built-in report that shows all schedules searches (searches, reports, dashboards, alerts, etc) no longer associated with an active user — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:12AM via IFTTT

@splunkanswers This *really* should be sinpler to do … along the lines of `| eval mvindex(mvfield,ndx)=“new value”` Except mvindex isn’t supported on the left side of the equals sign ?

This *really* should be sinpler to do … along the lines of `| eval mvindex(mvfield,ndx)=“new value”` Except mvindex isn’t supported on the left side of the equals sign ? — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:07AM via IFTTT

@splunkanswers One is an intermediary between an endpoint and indexers (HF) that might happen to do data massaging The other (HEC) eliminates the need for UFs

One is an intermediary between an endpoint and indexers (HF) that might happen to do data massaging The other (HEC) eliminates the need for UFs — Warren Myers ?? (@warrenmyers) October 24, 2019 from Twitter https://twitter.com/warrenmyers October 24, 2019 at 03:04AM via IFTTT