Hi, trying to get stats of user search stats. I'm struggling trying to workaround the 10K limit with distinct , stats dc(sids) in the below query.    ("data.search_props.type"!=other "data.search_props.user"!=splunk-system-user AND "data.search_props.user"!=admin data.search_props.sid::* host=* index=_introspection sourcetype=splunk_resource_usage) | eval mem_used='data.mem_used', app='data.search_props.app', elapsed='data.elapsed', label='data.search_props.label', intro_type='data.search_props.type', mode='data.search_props.mode', user='data.search_props.user', cpuperc='data.pct_cpu', search_head='data.search_props.search_head', read_mb='data.read_mb', provenance='data.search_props.provenance', label=coalesce(label,provenance), sid='data.search_props.sid' | rex field=sid "^remote_[^_]+_(?P<sid>.*)" | eval sid=(("'" . sid) . "'"), search_id_local=replace('data.search_props.sid',"^remote_[^_]+",""), from=null(), username=null(), searchname2=null(), searchname=null() | rex field=search_id_local "(_rt)?(_?subsearch)*_?(?P<from>[^_]+)((_(?P<base64username>[^_]+))|(__(?P<username>[^_]+)))((__(?P<app>[^_]+)__(?P<searchname2>[^_]+))|(_(?P<base64appname>[^_]+)__(?P<searchname>[^_]+)))" | rex field=search_id_local "^_?(?P<from>SummaryDirector)" | fillnull from value="adhoc" | eval searchname=coalesce(searchname,searchname2), type=case((from == "scheduler"),"scheduled",(from == "SummaryDirector"),"acceleration",isnotnull(searchname),"dashboard",true(),"ad-hoc"), type=case((intro_type == "ad-hoc"),if((type == "dashboard"),"dashboard",intro_type),true(),intro_type) | fillnull label value="unknown" | stats max(elapsed) as runtime max(mem_used) as mem_used, sum(cpuperc) AS totalCPU, avg(cpuperc) AS avgCPU, max(read_mb) AS read_mb, values(sid) AS sids by type, mode, app, user, label, host, search_head, data.pid | eval type=replace(type," ","-"), search_head_cluster="default" | stats dc(sids) AS search_count, sum(totalCPU) AS total_cpu, sum(mem_used) AS total_mem_used, max(runtime) AS max_runtime, avg(runtime) AS avg_runtime, avg(avgCPU) AS avgcpu_per_indexer, sum(read_mb) AS read_mb, values(app) AS app by type, user | eval prefix="user_stats.introspection." | addinfo | rename info_max_time as _time | fields - "info_*"   Can someone suggest a tweak in the SPL to get around distinct 10K limit? Thank you,   Chris

Getting error : "The lookup table 'Horizon_Feb_2022.csv' requires a .csv or KV store lookup definition." while running simple query "|inputlookup Horizon_Feb_2022.csv". Facing similar issue for other datasets as well.

Hi guys, Does anyone have the same problem where downstream tiers in a business transaction don't report their errors to a business transactions error metrics? For instance, a business transaction doesn't error on the first tier, but on a downstream tier connected by JMS it does. My expectation is an error should be reported in errors per minute for that business transaction. It does not. The errors are visible in the 'errors' tab however for this business transaction, but without error reporting in the metrics I am unable to alert off these errors. Interested to see if anyone has come across this problem or has a solution. Kind Regards, James

Hey. I have a dataset as follows: I have a 2nd dataset as follows::   I need to perform a lookup between both both I am getting 3 empty columns after the lookup from the 2nd dataset: Can you please help?   Here is the query I am using: |inputlookup ABC | eval AR_ID=_key | lookup XYZ AR_ID as _key OUTPUT NodeName as SW_NodeName, FQDN as SW_FQDN, Product as SW_App Thanks,

I have 2 partitions on my centos. The first one is 20 GB and mounted on / and the second one is 300 GB and mounted on /opt. Splunk service is in /opt/splunk directory  and i have 300 free on this partition. but i got disk space warning on / partition.  please help!

Hello everyone, In Splunk GUI when i run health check its showing one error like One or more source types has been found to present events in the future. All the sources are giving the correct timestamp with timezone UTC +0:00 but when i checked the devices that are configured with the source types with the error, the devices are in the other timezone i.e UTC +08:00, and we are receiving the logs that are also in the future timezone. so how can i overcome this problem with the future timestamp. the Splunk indexer time zone is UTC +0:00 please refer the screenshot. Thanks in advance............

I have the stores and I want to check the status of store whether it is up or down  i want to show the status with help of  processes   Processes.csv lookup  processes Services DeviceType ax Amazonx controller by buy register  I wrote a query but it is not showing the status up or down |mstats latest_time(value) as _time where (host="*" OR host="t*") index=a_store_metrics And metric_name="process.time" by host process |search process in ("ax","by") |eval host=lower(host) |rex field=host "(?<Device>["\.]+)" |rex field=Device "(?<store>\w{7})" |search [|inputlookup  store_device where store="a01" |field Device |format] |lookup store_device Device OUTPUT Store as storetype DeviceType |where (DeviceType="Controller" OR  DeviceType="Register") AND store="a01" |lookup process.csv  process OUTPUT Services |stats latest(_time) as time by instance store |eval status=if(time!="".,"UP","DOWN") |fields store instance service status  I am getting output store instance service status a01 ax amazon x UP a01 by buy UP   If i off the store it is not showing down it is showing only one instance suppose if I stop the services for by it should show status down in by column but it is not showing entire column as shown below. store instance service status a01 ax amazon x UP         Please help me  out Thank you                                                                          

The table's "previous" button works except when I'm going from Page 2 to Page 1 of the results. When I clicked "previous" the results stayed the same. The table's source is as follows: source=<<source>> | stats count by strategy_name | sort -num(count) | table strategy_name, count | rename strategy_name as "Alert Type", count as Count