Hi Ryan, I have followed the documentation- but none of predefined templates could pull out the required data from synthetic events- Property Value event.correlationId event.errorCode event.errorDesc event.id event.measurementId event.name event.scheduleId event.scriptExitCode event.sessionStatus These are properties which will be present in event details tab- Can you help me route to the right pre defined variable which can fetch these details . Thank you, Jahnavi

I see that you are new here.  But this is a Splunk forum.  Very few people will know what Cisco firewall events entail.  In fact, Cisco firewall can also have multiple forms.  @ITWhisperer is asking you to post sample (anonymized) or mock data.  You can use raw events, or field tables. You should also illustrate desired results.  Additionally, explain very clearly which part of the data will lead to your desired result and how.  In short, you need to explain how to get your desired results WITHOUT Splunk.

What do you mean by "total count"?  There is only one total in my vocabulary.  That's the opposite of the mockup chart in your original post that shows multiple bars at each depicted time point.  If you don't need to break down, all you need is | timechart count  

It is supposed to be a bar chart y axis denotes the login count and x- axis represents the time period selection we do in our search.... Those bars are representation of total count values of xxx,yyyy,aaa,bbb

Yes, eventstats can be expensive and possibly slower than join.  You can try switch the eventstats for fields in index _network instead. I don't understand why all in a sudden you are handling host instead of snat.  I will assume that you still want to match snat but with host in lookupfile representing the host portion like 10.10.10.10.  Is this correct?  You also lost matching _time (bucketed to 5m).  If all you want to match is the host portion of snat, i.e., if the lookup contains no _time info, you can have this very efficient search index=_network [ inputlookup lookupfile ``` assuming this only contains 10.10.10.10, 20.20.20.20 ``` | dedup host ``` you SHOULD produce a lookup file that contains no dup ``` | rename host AS snat | eval snat = snat . ":*" ``` the lookup file SHOULD use field name snat and contains asterisk without external work ```] | bucket span=1m _time | rex field=client "^(?<client_ip>.*?)\:(?<client_port>.*)" | stats count by _time snat client_ip However, if you still want to match _time and put bucketed _time column in lookupfile, the search will necessarily be more complex.  You will have to explain data (both in index and in lookupfile) and exactly what desired output looks like, and describe the exact logic connecting the dataset and desired output.

First thing to check is of course btool splunk btool inputs list --debug for the respective inputs.  If it shows renderXml set to false, for those inputs, then some other setting is overriding the setting you are trying to apply.  Adding the --debug flag lets you know which file provides the winning setting, so you can figure out where it is coming from.