Thanks for your answer but it does not solve the problem. I already tried to solve it  by refreshing the page, restart Splunk, use different browers (edge, firefox and chrome), but nothing helps. So I think the version of the app will not work in Splunk 9.1.1. Unfortunately the app is not supported so it looks like I must look for an alternative (if there is..). There is a Tag Cloud vizualisation but that is not so graphical as Wordcloud. 

Hi, I have been struggling to fix this blacklist in windows_ta app inputs.conf in the DS and deployed it to clients but it not working as expected, please help me in fixing this issue Still logs are ingesting.. Thanks Eagerly waiting for your answers....

你好 @yafei, Splunk 服务器可以访问的数据没有明确的限制。 例如，如果您有分布式集群/非集群环境，则它可以访问任意数量的事件。 如果询问特定于容量规划，下面是 2 个 Splunk 文档，可以帮助您解决相同问题 - - https://docs.splunk.com/Documentation/Splunk/9.1.1/Capacity/IntroductiontocapacityplanningforSplunkEnterprise - https://docs.splunk.com/Documentation/Splunk/9.1.1/Capacity/Referencehardware 另外，这里有一个类似的问题 - https://community.splunk.com/t5/Splunk-Enterprise/Capacity-planning-best-practices-for-Splunk-Enterprise/m-p/476931   如果有帮助，请接受解决方案并点击 Karma, 或者如果您对此有任何疑问，请告诉我！

I'm not aware of any such option.  Perhaps one of the DEBUG log settings will help. Failure to apply a regex is not an error - it just means the data doesn't match the regex, which is perfectly normal.

@_JP is correct that single quotes have special meaning in SPL.  Have you tested   index=_internal status=* | rename status AS HTTPStatus | stats count(eval(HTTPStatus >= 400 AND HTTPStatus < 500)) AS fourxxErrors, count(eval(HTTPStatus >= 500 AND HTTPStatus < 600)) AS fivexxErrors, count AS TotalRequests Can you share sample output from this?  

Yes, I also had that idea: So, calculate log(analog_value)  and plot that a linear Y axis? While that produces a proper visual, you can't read the value of analog_value any more (only it's log). But the illegibility of the true values still bothers me, which is why I was hoping for an even more perfect solution, somehow... Maybe there is none.

If the urls are consistent, that is a great idea.  Unfortunately, the urls have between 1 and 8 parts  This is rather confusing.  @ITWhisperer's command concatenates from the end, and it shouldn't matter whether there is 1 part in between or 8.  Have you tested in full search?   index=my_index sourcetype=my_sourcetype (rule=policy_1 OR rule=policy_2 OR rule=policy_3) [ | inputlookup my_list_of_urls.csv ] | eval my_url = mvjoin(mvindex(split(url, "."), -2,-1), ".") | stats count by my_url   between . and I don't know where to start.  Alternatively, if there is a way of adding what is in the csv to the results, that would work. Another piece of confusing comes from the original search:   index=my_index sourcetype=my_sourcetype (rule=policy_1 OR rule=policy_2 OR rule=policy_3) [ | inputlookup my_list_of_urls.csv ] | rename url AS my_url | stats count by my_url | table my_url If you table my_url in the end, the result is no different from using inputlookup alone.  Why bother with index search?  If you only want mircrosoft.com and office.com from the CSV, you could do | inputlookup my_list_of_urls.csv | eval my_url = mvjoin(mvindex(split(url, "."), -2,-1), ".") | stats values(my_url) as my_url | mvexpand my_url   Maybe you can describe more variety of data (anonymize as needed) and print output from proposed searches, then illustrate what desired outcome is and explain why the actual output is not desired (in case it is not obvious enough)?  

In this case if you just care about the max TotalScore, you can just reverse-sort your data by TotalScore and use head to grab to first (aka the max) one:   | makeresults format=csv data="Class,Name,Subject,TotalScore,Score1,Score2,Score3 ClassA,Name1, Math, 170, 60 ,40 ,70 ClassA,Name1, English ,195, 85, 60, 50 ClassA,Name2, Math, 175, 50, 60, 65 ClassA,Name2, English ,240, 80, 90, 70 ClassA,Name3, Math, 170, 40, 60 ,70 ClassA,Name3, English ,230, 55, 95, 80" | sort -TotalScore | head 1 | table Class Name, Subject, TotalScore, Score1, Score2, Score3   Here's a screenshot:        

Hello, I only need 1 row displaying all fields that has the Max TotalScore of 240     Class Name Subject TotalScore Score1 Score2   Score3 ClassA Name2 English 240 80 90 70 Thank you