I'm trying to build a query to give real time results for a value, but the is a time delay between the data send and indexed. This means when I do a realtime query for last 60s, I get 20s of data and 40s of blank. I'd like to load the last 60s of recieved data in realtime, not the data recieved in the last 60s. Any ideas? I've tried index=ind sourcetype=src (type=instrument) | where temperature!="" | timechart span=1s values(temperature) and index=ind sourcetype=src (type=instrument) | where temperature!= NULL | timechart span=1s values(temperature) No luck with either

Hi, I want to extract value c611b43d-a574-4636-9116-ec45fe8090f8 from below. Could you please let me know how I can do using rex field=httpURL   httpURL: /peerpayment/v1/payment/c611b43d-a574-4636-9116-ec45fe8090f8/performAction

Hi All, We are deploying out the Splunk Universal Forwarder at the moment which is going well but I'm looking at getting this installed on our Citrix Infrastructure. In our environment, we have "Golden Images" where we make changes. Once published (Using PVS), the new image will be deployed out to the Citrix servers in that specific delivery group. When the server/s (None-Persistent) in that group performs their reboots which is nightly they pick up the golden image via PVS. Using the clone prep command works and the new client comes through in the Forwarder Management without any issues which I'm happy with as it is working as expected but as these servers reboot every night, I'm finding that duplicate entries of the same servers are being created when the reboot completes and Splunk connects to the deployment server. I'm presuming that this is because the GUID is changing every time these servers reboot in the night but I want to know if there is a way to ensure it uses the same GUID for that hostname so that it avoids creating duplicate records in the Forwarder Management console? Or if there is some option somewhere where Splunk identifies a duplicate hostname and removes it automatically? For example, this is how it works: SERVERMAIN01 - Citrix Maintenance Server where golden images are attached and changes can be made. SERVERAPP01 - Application server which picks up golden image (None-Persistent) and is rebooted nightly SERVERAPP02 - Application server which picks up golden image (None-Persistent) and is rebooted nightly SERVERAPP03 - Application server which picks up golden image (None-Persistent) and is rebooted nightly So essentially, I'm getting duplicate clients in the Forwarder Management for SERVERAPP01/02/03 every night which will just build up over time unless I manually intervene which takes up my time. Hope this all makes sense and someone can point me in the right direction as I've searched around for a while and can't find any posts around this. Cheers,