the "unwanted logs" is a very vague term and the ES app definitely got no app to monitor this vagueness.  as said by above reply, you should fine-tune what to ingest and what not to ingest(and send it to null-queue). 

this should be tested. maybe i will give it a try today evening.  well, looks like the developers made some basic errors.. even if we raise support ticket for this, splunk would consider this as low priority ticket.   

now I see  first I missed double quote, so you are correct - so my search is:  | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | timechart avg("value1") span=10s useother=false BY host WHERE max in top5   now, if I want to search by what you worth: | mstats avg("value1") prestats=true WHERE "index"="my_index" span=10s BY host | untable _time host average | stats dc(host) as c_host    OR | timechart avg("value1") span=10s useother=false BY host WHERE max in top5 | untable _time host average | stats dc(host) as c_host     Anyway, I want to use mstats function and get a count for the host. 

Short answer - no, there isn't. Longer answer - but you could write an app to do it.   Assuming that you don't care for events of the sourcetype foo, you could set up an app on your indexers that looks like: props.conf [foo] TRANSFORM-route_to_nullQueue = route_to_nullQueue transforms.conf [route_to_nullQueue] INGEST_EVAL = queue := "nullQueue"   Once active, events of sourcetype foo won't be ingested and won't count towards your daily ingest license.

three ideas... 1) As i heard, the Splunk Essentials app got some sample data.  https://splunkbase.splunk.com/app/3435 2) and then you can find some sample data in this repo: https://github.com/splunk/botsv3 3) and then, there is an app.. EventGen. very difficult to configure and very worst documentation. i would suggest this as last resort. thanks. 

You can use conditions in drilldowns to determine which field/column has been clicked <drilldown> <condition field="Name"> <link target="_blank">your search link</link> </condition> <condition field="Organization"> <link target="_blank">your organisation link</link> </condition> </drilldown>

| mstats avg("value1) prestats=true WHERE "index"="my_index" span=10s BY host has a missing double quote so will give you an error Also, assuming that this is corrected, you will get a field called something like "avg(value1)" This means that you no longer have a field called "value1" so the timechart command has no field to do an average on. This is why the search you provided does not work. Assuming it is the timechart table that you want to count hosts for, you could untable the chart table | untable _time host average | stats dc(host) as c_host | where c_host < 3  

Sorry i forget to write very important things I have many events with the same key  for example: 10/4/23 1:23:03.000 PM   {"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d 10/4/23 1:24:03.000 PM {"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d 10/4/23 1:25:03.000 PM {"key":"27.09.2023","value_sum":35476232.82,"value_cnt":2338} Show syntax highlighted host = app-damu.hcb.kz source = /opt/splunkforwarder/etc/apps/XXX/pays_7d.sh sourcetype = damu_pays_7d   ... and for other KEY  for example key":"29.09.2023" many events   in the result i want to see only one unique row for KEY I try to search  index=hcg_app_damu_prod sourcetype="damu_pays_7d" | spath input=json | table _time, key ,value_sum, value_cnt | stats latest(key), latest(value_sum) ,latest(value_cnt)   but it give me just only one row.  

not sure why you say that. but its working. just to be clear = value1 = to some internal parameter. index = my index. and base on that Im getting information about  the hosts .  now I just want to count how many hosts reporting, when its less then 3 I want to trigger about it.  hope its clear now. 

I have checked internal events only logging for 5 of them are in the _internal  I have  windows eventlog for Dc2 and 5 on the Wineventlog I will check aging the UF to see where is the problem Much appreciate your help @PickleRick   

This is rather confusing.  It seems that Splunk already gives you fields "key", "value_sum", and "value_cnt".  You want to rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt".  Is that all?  Are you just looking for rename? | rename "key" as "day", "value_sum" as "sum", "value_cnt" as "cnt" | table day sum cnt Something like that.