So i am using the below search run over the past 365 days, however it is only providing me with the last month. How do i get the average monthly ingest (excluding weekends) for each month over the past year? index=_internal source=*license_usage.log* type="RolloverSummary" splunk_server=* NOT date_wday IN ("saturday", "sunday") | stats avg(b) AS bytes BY date_month | eval TB=(bytes/1024/1024/1024/1024)

The equal sign might be causing issues, escape them with backward slash. Also, the OR keyword between two stats fields is invalid, remove it. index=abcd | stats count(eval(searchmatch("https://drive.google.com/uc?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"))) as "https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X" count(eval(searchmatch("value2"))) as "value2"

Try this query.  The transpose command "rotates" the results table into the desired format. | makeresults | eval data="1997-10-10 15:35:13.046, CREATE_DATE=\"1997-10-10 13:36:22.742479\", LAST_UPDATE_DATE=\"1997-10-10 13:36:22.74\", ACTION=\"externalFactor\", STATUS=\"info\", DATA_STRING=\"<?xml version=\"1.0\" encoding=\"UTF-8\"?><externalFactor><current>parker</current><keywordp><encrypted>true</encrypted><keywordp>******</keywordp></keywordp><boriskhan>boriskhan1-CMX_PRTY</boriskhan></externalFactor>\" 1997-10-10 15:35:13.046, CREATE_DATE=\"1997-10-10 13:03:58.388887\", LAST_UPDATE_DATE=\"1997-10-10 13:03:58.388\", ACTION=\"externalFactor.RESPONSE\", STATUS=\"info\", DATA_STRING=\"<?xml version=\"1.0\" encoding=\"UTF-8\"?><externalFactorReturn><roleName>ROLE.CustomerManager</roleName><roleName>ROLE.DataSteward</roleName><pepres>false</pepres><externalFactor>false</externalFactor><parkeristrator>true</parkeristrator><current>parker</current></externalFactorReturn>" | eval data=split(data," ") | mvexpand data | eval _raw=data | fields - data ``` Everything above sets up demo data. Delete IRL ``` ``` Extract keys and values ``` | rex max_match=0 "<(?<key>[^>]+)>(?<value>[^<]+)<\/\1>" ``` Match keys and values so they stayed paired during mvexpand ``` | eval pairs=mvzip(key,value) | mvexpand pairs ``` Separate key from value ``` | eval pairs=split(pairs,",") ``` Define key=value result ``` | eval key=mvindex(pairs,0), value=mvindex(pairs,1) | fields key,value | fields - _* | transpose 0 header_field=key

Give this a try Your base search to get all workstation names e.g. | tstats count WHERE index=windows by host | searc NOT ([| inputlookup code_countries.csv | table alpha-2 | eval host='aplha-2'."*" | table host]) | where match(host,"^\w{3}\d+")

@gcusello  No Recent Logs Found for Source: abc:conf No Splunk ingestion for Glo_Pa Alxt Ingestion found in the last 24 hours for: Index: glo_pa_logs SourceType: abc:conf   How to find in SSH or in UI

Its great, i have all key as in field_header and all valuesas in field_value assigned to a field called paris. So, here all key and value extracted in one field called paris. But, i'm trying to extract field headers and field values from raw data. As to search for SPL query "index=index_name sourcetype=sourcetype |table current, encrypted, keywordp,boriskhan, rolename, prepres, externalFactor, parkeristrator".   so, what i got is field_header as paris and field_values as current=parker,  encrypted=true,  .  .  .  .  paris current=parker encrypted=true keywordp=****** boriskhan=1-CMX_PRTY roleName=ROLE.CustomerManager pepres=false externalFactor=false parkeristrator=true current=parker   What goal is, field_header_1 is current, field_header_2 is encrypted, field_header_3 is keyword as below and to get field_headers showup in Splunk interesting fields with its values. current encrypted keywordp boriskhan roleName pepres externalFactor parker true ****** 1-CMX_PRTY ROLE.CustomerManager false false  

Hi @AL3Z , if the above search doesn't work for you, but you want to filter for src_ip and dest_ip, you could try: index=your_index sourcetype=your_sourcetype src_ip="xx.xx.xx.xx" dest_ip="yy.yy.yy.yy" | stats values(dest_url) AS dest_url values(logs) AS logs sum(bytes_in) AS bytes_in sum(bytes_out) AS bytes_out | eval traffic_MB_size=(bytes_in+bytes_out)/1024/1024 Ciao. Giuseppe

What is the problem you are having with that query (other than the spelling errors)? FWIW, the value of the startswith argument must be a valid SPL search or eval expression.  The current value is neither.