Hi @New_splunkie, It's great to see your interest in Data Manager! You're absolutely correct – Data Manager is a native app to the Splunk Cloud Platform, which means there's no separate installation required. However, there are a few requirements that your deployment must meet in order to have it on your Splunk Cloud Platform.  You can use Data Manager if your Splunk Cloud Platform deployment meets the following requirements: Runs Splunk Cloud Platform versions 8.2.2104.1 and higher on the Victoria experience. Is provisioned in a region that supports Data Manager. See Available regions and region differences in the Splunk Cloud Platform Service Description. Please let me know if that helps! Antoni 

As I said, it depends on your data. For example, Apache HTTPD logs (and other HTTPD servers) log transactions using the timestamp for when the request was received, but it is added to the log when the response is sent back. This means that the event time could be minutes out from the index time even if the log was indexed instantaneously (which it isn't as there will always be a lag between when the log is written and when it reaches the indexers). However, in this instance, the time the response was sent could be inferred from the request time and the duration, so this could be used to compare against the index time to give you a better idea about the lag. Perhaps what might be more useful to you is the difference between successive index times? This might show you when either there was a pause in logging or when there was a breakdown in transmission of the log events to the indexers. However, this would need to be compared with the actual rate at which the events were written to the log, so, again, it depends on your data.

Brackets in the wrong place and it looks like the else part of the first if should start with another if | eval Test= if( (like('thrown.extendedStackTrace',"%403%"),"403", if(like('thrown.extendedStackTrace',"%404%"),"404","###ERROR####"))

Hello @ITWhisperer, Thank you for your response. If I take duration of last 10 days, for some hours I get more index data points than event data points, and over the time it changes to more event data points to index data points. Additionally, there is no clear cyclic pattern observed during the day when this change happens, that some duration of time former is observed and some other duration latter is observed. The problem I am trying to solve is to identify potential data ingestion issue that may exist with respect to a given data source. That is the anticipated pattern would have event data points and indexed data points closely follow same pattern and the event data points volume will be slightly greater than or equal to indexed data points. But, when the event data points pattern and indexed data points pattern are not same over the same period of time or we may have more number of indexed data points than event data points, that is when the issue may be occurring. This is the problem I am trying to identify at run time or close to run time and later address with respect to each data source. Please share if the above helps to answer your questions to seek more guidance on the topic. Thank you

  Set this alert to run every 30 minutes looking back for 1 hour index=my_index source="/var/log/nginx/access.log" | stats avg(request_time) as Average_Request_Time | streamstats count as weight | eval alert=if(Average_Request_Time>1,weight,0) | stats sum(alert) as alert | where alert==1  

Are you saying that for every hour there are more index data points than event data points, or that it happens sometimes? Even then, lets say you have a lag between the event time and the index time and that indexing happens at 5 minutes past, but the events picked up are timestamped from 5 minutes before to 5 minutes past. The count for that index time will include events which are not in that hour. Index time and event time are two different scales running independently of each other. Depending on your source data, events may be indexed before or after their event time. What problem is it that you are trying to solve?

I found that using the following match condition is enough to get the job done. <condition match="$row.gender$==&quot;female&quot;">  Thanks for your answer. It lets me find out that there is a thing called conditional drilldown!

Having a similar issue, | eval Test= if( (like('thrown.extendedStackTrace',"%403%"),"403"),(like('thrown.extendedStackTrace',"%404%"),"404"),"###ERROR####") But getting error as --> Error in 'EvalCommand': The expression is malformed. Expected ).