Hi @Praz_123, you should create an alert when data flow stopped and immediately see if there something that blocked it. then, if the data flow arrives from text files, you could see if in the files there are data in the missing periods. Ciao. Giuseppe

@gcusello  Thanks for your reply , but the data is visible like in 7 days it will be like 6 days visible 1 day missing or 5 days visible 2 days missing vice-versa . what could be solution for that 

Hi @Praz_123, if one sourcetype was present and noy it's missing, there could be two reasons: you modified the inputs.conf assigning the sourcetype to a data flow, the data flow stopped. You can check the first choice viewing if someone modified the inputs.conf that should ingest data. For the second choice you should analyze, if you're still receiving data and when the data stopped: index=your_index sourcetype=your_sourcetype | head 10 Ciao. Giuseppe

Hi @karimossl, let me understand: do you want to find all the Computernames from Active Directory logs that aren't in the lookup or what else? if this is your requirement, you could run: index=win* NOT [ | inputlookup code_countries.csv | rename alpha-2 AS ComputerName | fields ComputerName ] | dedup ComputerName | sort ComputerName | table ComputerName Ciao. Giuseppe

@gcusello  its not dropping those DEBUG ones props- [risktrac_log] LINE_BREAKER = ([\r\n]+)\[\d{2}.\d{2}.\d{2}.\d{2}.\d{2}.\d{2}.\d+.\w+ MAX_TIMESTAMP_LOOKAHEAD = 35 SHOULD_LINEMERGE = 0 TIME_PREFIX = ^ TRUNCATE = 99999 pulldown_type = 1 TRANSFORMS-null = setnull   transforms- [setnull] REGEX = DEBUG DEST_KEY = queue FORMAT = nullQueue

Hi @syazwani ... As said by PickleRick, there is no Splunk command as "distance" 1) For other new Splunker's info about Splunk's Search Commands.. pls check the Splunk search reference document.. https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Rex (i copied rex command's link... on the left side you will see a list of commands, alphabetically) 2) this should be from a app or add-on... mostly from a macros.conf file from that app/add-on  so, pls try to look into the macros conf files.  3) may we know if this was working previously and just recently it didnt work? was there any app/add-on upgrades?  4) not sure, but, lets try... that error msg got an yellow triangle.. like a splunk warning msg.. are you able to click on it?.. does it give you more details?  5) on the internal logs for that app/add-on, do you see any warnings/errors