I had this same problem so I thought I would share. For me, I was dealing with a clustered Environment. I went and looked at Splunkd.log and saw a bunch of messages like network unreachable and could not connect to peer etc.  Turned out Splunkd was down.  Restarted Splunkd on the CM and it reconnected. Hope that helps someone in the future.

The JS is implemented through an external file, colorFormat.js. I have overwritten that file but for some of my users they are getting the old file ran instead of the new one. Which in my mind doesn't make sense because how would splunk still have that code, since I have overwritten it?

11/06/2023 23:57:02 +1100, info_min_time=1699189200.000, info_max_time=1700571600.000, info_search_time=1700625838.094, foo=3, Mixed=0, CaseQty=64, OrderId=52128969634, TrayQty=35, Location="DEP/AutoDep03", Dimension=2, TrayError=3, OrientationError=1, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = D:\Splunk\var\spool\splunk\d0d3783e41cf130c_events.stash_newsourcetype = stash ===================================================================== 11/06/2023 23:57:02 +1100, search_name="File Collector: DepTrayCaseQty", search_now=1699279200.000, info_min_time=1699189200.000, info_max_time=1699275600.000, info_search_time=1699279202.226, foo=2, Mixed=0, CaseQty=29, OrderId=52128969634, TrayQty=17, Location="DEP/AutoDep03", Dimension=2, TrayError=2, OrientationError=0, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = File Collector: DepTrayCaseQtysourcetype = stash ================================================================= 11/06/2023 23:57:02 +1100, info_min_time=1699189200.000, info_max_time=1700398800.000, info_search_time=1700618994.511, foo=3, Mixed=0, CaseQty=64, OrderId=52128969634, TrayQty=35, Location="DEP/AutoDep03", Dimension=2, TrayError=3, OrientationError=1, ProtrusionError=0, CaseTypeId=6210, WidthError=2, reporttype=DepTrayCaseQty, OffCentreError=0, HeightError=0, LengthError=0, PalletLayers=4 OrderId = 52128969634host = MSRDC-BPIsource = D:\Splunk\var\spool\splunk\adb0f8d721bf93e3_events.stash_newsourcetype = stash

Hi @AL3Z, are they windows events? if yes, you can blacklist them, if not, you cannot blacklist them in inputs.conf. Then you have to check if the regex I shared is correct or too large, for this reasono I asked to share also events to not discard. Ciao. Giuseppe

summary is the default index for summaries but you can collect to different indexes. I can't tell from your screenshot whether these are for the same index or not. Perhaps you should collect additional information about these sources e.g. exactly when did they update, what other fields are in the summary events, etc.

As @ITWhisperer said, you cannot use str*time functions to convert those correctly. Here is another example for converting those correctly and calculate avg and sum and then convert those back to duration. This is not handling durations which are greater than 23:59:59. | makeresults | eval duration="01:00:01,00:15:00,10:10:10,05:04:03" | eval duration = split(duration,",") | mvexpand duration ``` above create test data ``` | eval d1 = split(duration,":"), d=tonumber(mvindex(d1,2)) + 60 * tonumber(mvindex(d1,1)) + 3600 * tonumber(mvindex(d1,0)) | stats sum(d) as tD1 avg(d) as aD1 | eval sum_duH = floor(tD1/3600), sum_duM = floor((tD1%3600) / 60), sum_duS = floor(tD1 % 3600 % 60) | eval avg_duH = floor(aD1/3600), avg_duM = floor((aD1%3600) / 60), avg_duS = floor(aD1 % 3600 % 60) | eval avg_D = printf("%02d:%02d:%02d", avg_duH, avg_duM, avg_duS) | eval sum_D = printf("%02d:%02d:%02d", sum_duH, sum_duM, sum_duS) | table avg_D sum_D r. Ismo 

Using strptime() and strftime() are for handling epoch date times which is why you are getting strange numbers. You might be better to do something like this: | rex field=DURATION "(?<hours>\d+):(?<minutes>\d+):(?<seconds>\d+)" | eval DURATION=((hours*60)+minutes)*60+seconds | stats sum(DURATION) as event_duration by NAME | eventstats sum(event_duration) as total_time | eval percentage_time=(event_duration/total_time)*100 | eval event_duration1=tostring(event_duration,"duration") | eval total_time1=tostring(total_time,"duration") | eval av_time_hrs=(event_duration/total_time) Having said that, I am not sure what the final calculation is supposed to be showing