I'm speaking about the Splunk Enterprise.  Via that site: System requirements for use of Splunk Enterprise on-premises - Splunk Documentation, it looks like all versions of SPlunk (up to 9.1.2) will work on Linux 3.x and 4.x kernels.  My concern about the 8.2.x is that SPlunk clearly says this is no longer supported since 9/30/23.

Hi @dcfrench3 , you can put both the searches in the main search and then use stats By the search keys to correlate events, something like this: (index="iis_logs" sourcetype="iis" s_port="443" sc_status=401 cs_method!="HEAD") OR (index="windows_logs" LogName="Security" Account_Domain=EXCH OR Account_Domain="-" EventCode="4625" OR EventCode="4740" user="john@doe.com" OR user="johndoe") | eval c_ip=coalesce(Source_Network_Address,c_ip) | stats dc(index) AS index_count values(*) AS * BY c_ip | where index_count=2 I don't know which fields you need, so I used values(*) AS * but you can use the fields you need. Ciao. Giuseppe

Ciao Giuseppe! Thank you a lot for your answer! We finally saw it was something related to a configuration on our firewall because we couldn't even see our IP going to Splunk through the firewall and the services were up and running on the server with Splunk Universal Forwarder installed. Regarding the Deployment server, we have ~20 servers with Splunk Universal Forwarder installed on them. Should we have a deployment server in the same environment to be able to manage all of those Splunk UFs? Do you have any recommendation on this?   Thanks again! Juanma  

With the assumption the field MSG_DATA is properly extracted and a valid XML object then I think this SPL will get you a MV field of "file_title". <base_search> | eval file_title=coalesce(spath(MSG_DATA, "Message.additionalInfo.fileDetails{}.fileDetail.title"), spath(MSG_DATA, "Message.additionalInfo.fileDetails.fileDetail.title")) Screenshot of it on my local instance:  

Assuming the fields are already extracted, the stats command should do what you want. | stats count(eval(JOB_RESULT="success")) as TOTAL_SUCCESS, count(eval(JOB_RESULT="fail")) as TOTAL_FAILS by PROJECT_NAME, JOB_NAME  

I'm not sure If I am completely understanding the ask here but will give it a shot. So just going off your 2 sample events I think something like this would work. (There is an assumption that the fields "JOB_RESULT", "JOB_NAME", and "PROJECT_NAME" are already extracted and ready to use) This search is tallying up the success and fails across all jobs grouped into the projects, so each project will have its own row in the final results. <base_search> | stats count(eval('JOB_RESULT'=="success")) as TOTAL_SUCCESS, count(eval('JOB_RESULT'=="fail")) as TOTAL_FAILS by PROJECT_NAME  Output would look something like this. Or if you need it more granular to see the numbers at the Job level you can use this. <base_search> | stats count(eval('JOB_RESULT'=="success")) as TOTAL_SUCCESS, count(eval('JOB_RESULT'=="fail")) as TOTAL_FAILS by PROJECT_NAME, JOB_NAME  This will provide you output that each unique combo of PROJECT_NAME/JOB_NAME will have their own row and output would look like this. For reference, here is the SPL used to simulate your problem on my local instance. | makeresults | eval _raw="{ PROJECT_NAME = project1 JOB_NAME = jobA JOB_RESULT = success }" | append [ | makeresults | eval _raw="{ PROJECT_NAME = project2 JOB_NAME = job2 JOB_RESULT = fail }" ] ``` | extract pairdelim=" " kvdelim="=" | stats count(eval('JOB_RESULT'=="success")) as TOTAL_SUCCESS, count(eval('JOB_RESULT'=="fail")) as TOTAL_FAILS by PROJECT_NAME ``` | extract pairdelim=" " kvdelim="=" | stats count(eval('JOB_RESULT'=="success")) as TOTAL_SUCCESS, count(eval('JOB_RESULT'=="fail")) as TOTAL_FAILS by PROJECT_NAME, JOB_NAME

Hi @AL3Z, you cannot compile (in literal sense) an app in Splunk. You have a predefined folder structure in which you can put you conf files and then aggregate (using tar.gz) in an app. Here you can find the information you need. Ciao. Giuseppe

In the mean time why don't you try appending "+0000" to your REPORTED_DATE and convert to epoch including the timezone specifier This was  perfect and worked great. I am very interested in macros I have never done them can you help me build the ones out you did