https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264086#M79275 <P>You should add <CODE>host</CODE> to your group by clause. Like this</P> <PRE><CODE>index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time) </CODE></PRE> Tue, 06 Dec 2016 20:17:52 GMT sundareshr 2016-12-06T20:17:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264085#M79274 <P>Hello </P> <P>We are trying to use the search below to calculate response times. The search is looking for a thread ID in the 'United_Send.log" and its matching thread id in the 'United_Receive.log'. It then calculates the difference in the two time stamps associated with the thread ids. The application producing this log is running on 3 different servers. The problem, it's possible for the same thread ID to exist on all three servers. We are seeing odd results in the graph. I believe it’s because it's running the calculation against thread ID on different servers. How do I get the searches to run against each server, not across them?</P> <P>Search Example:</P> <PRE><CODE>index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time) </CODE></PRE> <P>Thanks</P> Tue, 29 Sep 2020 12:01:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264085#M79274 cj039165 2020-09-29T12:01:56Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264086#M79275 <P>You should add <CODE>host</CODE> to your group by clause. Like this</P> <PRE><CODE>index=hdx_payer host=* source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Receive.log" OR source="/hdx2/was70-32/AppServer/profiles/AppSrv01/logs/PRD2_PY0/UNITED_Send.log" | eval Time=_time | stats values(Time) as Time by host thread_id | where mvcount(Time)=2 | eval response_time=tonumber(mvindex(Time,1))-tonumber(mvindex(Time,0)) | convert ctime(Time) </CODE></PRE> Tue, 06 Dec 2016 20:17:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264086#M79275 sundareshr 2016-12-06T20:17:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264087#M79276 <P>Thanks for the help.</P> Tue, 06 Dec 2016 20:23:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-my-searches-to-run-against-the-logs-of-each-server/m-p/264087#M79276 cj039165 2016-12-06T20:23:38Z