Hi Andre, Thanks for sending me your script (in private) and sorry for the delay in my reply. It's as I suspected: your fill_in function is correct but is actually unused in your script.
You write: icmp3 = fill_in(sstol) icmp3 = mksafe(.....switch([....sstol....])) output...(...icmp3) The first definition of icmp3 is overriden by the second, and so it is useless. In terms of the graphs that we draw in the tutorials to give an intuition of what you're doing, you're first defining a sstol node, then creating a first icmp3 node connected to sstol by the fill in, and then creating another icmp3 node connected (through several operators including mksafe and switch) to the original sstol. So you have two branches, but the first one is ignored in the following and in particular isn't connected to an output, so it's never pulled/activated. A more sensible script would be: icmp3 = mksafe(...switch(...sstol)) icmp3 = fill_in(icmp3) output(...icmp3) Hope this helps, David ------------------------------------------------------------------------------ Index, Search & Analyze Logs and other IT data in Real-Time with Splunk Collect, index and harness all the fast moving IT data generated by your applications, servers and devices whether physical, virtual or in the cloud. Deliver compliance at lower cost and gain new business insights. Free Software Download: http://p.sf.net/sfu/splunk-dev2dev _______________________________________________ Savonet-users mailing list Savonet-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/savonet-users
