In a general case, both index=whatever | stats count and | tstats count where index=whatever run over a static period of time in the past should give you the same result. If there is a difference it might mean that you're still ingesting data into that period of time so subsequent runs of either of those commands will yield different results. But if you have a repeatable two different static values of those searches it might signal bucket corruption.

Hello @gcusello , Thank you so much for your response truly appreciate it. It's a pretty interesting issue. When I use [without condition] : | inputlookup account_audit.csv | eval updatedate=strptime(UPDATE_DATE, "%m/%d/%y" %H:%M:%S), comparetdate=now()-86400*30 | table account_id Name Org_Code UPDATE_DATE getting (7 independent events) 121 test Y 01/24/2024 04:52:10 121 test Y 01/24/2024 04:52:12 121 test Y 01/24/2024 04:52:11 123 test2 A 01/30/2024 12:50:11 123 test2 A 01/30/2024 12:50:20 126 test3 B 02/01/2024 11:12:23 126 test3 B 02/01/2024 11:12:21 But when I use (with condition) | inputlookup account_audit.csv | eval updatedate=strptime(UPDATE_DATE, "%m/%d/%y" %H:%M:%S), comparetdate=now()-86400*30 | search updatedate>comparedate Name=* | table account_id Name Org_Code UPDATE_DATE getting (3 events and each event separated by dotted line for clear understanding) 121 test Y 01/24/2024 04:52:10 121 121 --------------------- 123 test2 A 01/30/2024 12:50:10 123 ------------ 126 test3 B 02/01/2024 11:12:02 126  

PickleRick, I found the answer to my question.   The answer : If when searching an index for data you come across an event that appears to be raw text... Note the source type and verify it is created (settings > source types >( search the specific index and create it if it does not exist) (in Search and reporting) click the drop down associated with the event that contains "raw" text. click the drop down titled "Event Actions." select extract fields. observe the log and select the appropriate delimiter. name your fields. assign appropriate permissions. and enjoy.   To answer your questions I chose not to use Splunk base apps or addons for this particular task because these particular apps and addons are not intuitive to configure and hard to find usable documentation for.  I do not know how to identify if I am using fast mode search or not.   Thanks for the help    

I was able to fix my issue with symbolic links, thanks to the following topic. https://community.splunk.com/t5/Deployment-Architecture/How-to-move-index-from-one-hard-drive-to-another-in-Splunk/m-p/170733 Here is the steps I did: I created two directories on each volume, like this mkdir /Splunk-Storage/HOT/HOT1 mkdir /Splunk-Storage/HOT/HOT2 mkdir /Splunk-Storage/COLD/COLD1 mkdir /Splunk-Storage/COLD/COLD2  I stopped Splunk on one Indexer. Then moved the indexes to the appropriate directories as desired mv /Splunk-Storage/HOT/testindex1 /Splunk-Storage/HOT/HOT1/testindex1 mv /Splunk-Storage/COLD/testindex1 /Splunk-Storage/COLD/COLD1/testindex1 mv /Splunk-Storage/HOT/testindex2 /Splunk-Storage/HOT/HOT2/testindex2 mv /Splunk-Storage/COLD/testindex2 /Splunk-Storage/COLD/COLD2/testindex2 It took no time of course. Then I created symbolic links just like this ln -s /Splunk-Storage/HOT/HOT1/testindex1 /Splunk-Storage/HOT/testindex1 ln -s /Splunk-Storage/COLD/COLD1/testindex1 /Splunk-Storage/COLD/testindex1 ln -s /Splunk-Storage/HOT/HOT2/testindex2 /Splunk-Storage/HOT/testindex2 ln -s /Splunk-Storage/COLD/COLD2/testindex2 /Splunk-Storage/COLD/testindex2 Then I started Splunk. At this point, Splunk remained unaware of the changes occurring on the underlying file system, yet it continued to function, with the actual data now residing in the correct path. After repeating this process on all indexers, I proceeded to modify the indexes.conf on CM and pushed the changes. After checking that everything is correct, I removed the soft links.

Hi @gcusello @ITWhisperer  | rex field=result "\w:\\\\\w+\\\\\w+\\\\(?<myfield>[^\.]+)" The above query extracts, but if i want to extract APP and WEB which is in same line how to extract ? Fi a:\abc\def\MNOPQ.txt content is expected to include "A H Dis Query,0,0" Fi a:\abc\def\APP.txt content is expected to include "A H Dis Query,0,0" Fi a:\abc\def\WEB.txt content is expected to include "A H Dis Query,0,0" Fi a:\abc\def\SQL.txt content is expected to include "A H Dis Query,0,0"