It sounds like you might want a slightly different format for your single value: Assuming that you are only searching "today", _time can be removed. index=dot_activemq_jmx mbean_property_destinationName=RTGOrder | stats range(Messages_Enqueue) AS "Total Process Orders Today" by jvmDescription Is there more than one value of jvmDescription? If not, then you can get rid of that too in the stats command. ... View more

A little warning, with sort, dedup, and streamstats before the first reporting command, timechart, that search will perform poorly. ... View more

286 results have the lookup columns added. Do you want to see the count of hosts in the lookup not reporting in from your search time window? If so, instead of lookup, use | append [| inputlookup client_sys] and then uses a stats to bring the two together to show which are not shown, a filter on those not present in the data, and then a stats to count the ones not filtered. | tstats count AS tstats_cnt where index = main OR index = client* by host | append [| inputlookup client_sys | rename hostname AS host ] | stats first(tstats_cnt) AS tstats_cnt by host | search NOT tstats_cnt=* | stats count AS host_dc ... View more

better to avoid subsearches and replace inputlookup with lookup. ... View more

[edit] You need to use append inputlookup to see hosts not reporting in. Also I recommend tstats since you only use host: | tstats count AS tstats_cnt where index = main OR index = client* by host | append [| inputlookup client_sys | rename hostname AS host ] | stats first(tstats_cnt) AS tstats_cnt by host | search NOT tstats_cnt=* | stats count AS host_dc Other notes: client* had a space between which didn't make sense so I combined them. client_sys should be a lookup definition properly defined with a connection to an uploaded lookup file ending in .csv Double check the field name hostname in the lookup file. ... View more

It most likely stopped working due to something other than the time picker addition. I would have to webex with you to look more closely for the issue which stopped the search from working. I recommend checking that the data is still coming in, that the fields are still being extracted, and that there are no time issues with the search. The search query provided looks like it will do the job, but I would optimize it a bit to make stats do more of the work: index=dot_jmx destinationName=RTGOrderProcessed | bucket _time span=1d | stats range(Messages_Enqueue) AS "Total Process Orders Today" by jvmDescription destinationName _time The fact that he screened out large orders indicates a potential worry about catching a period when the Messages_Enqueue value resets. If that does not happen at midnight, consideration will need to be made for that. ... View more

In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index. All that said, | table * includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a | fields - _* to remove the underscore fields and a few others like sourcetype, host, source, index, etc. Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using collect instead of tscollect . ... View more

Sample regex has many issues: \w+:\\\w+\\\w+\(?P\w+\\\w+) While the sample regex fails to escape the backslash correctly or name the capture group, here is what I think that you are trying to match: | stats count | eval FILENAME="d:\\A\\B\\C\\D\\E\\F.dll" | rex field=FILENAME "(\w+[\:\\\]+){3}(?<my_field>\w+\\\+\w+)" | table FILENAME, my_field ... View more

My bet is that your ip exists in the host field and not in the _raw text. [setnull] REGEX = 10\.3\.0\.1[12] SOURCE_KEY=MetaData:Host DEST_KEY = queue FORMAT = nullQueue ... View more

This approach does not appear to be able to handle when the first event is not "yes": | makeresults | eval data="Col_A=\"ID_A\",Col_B=\"log 0\",Col_C=\"no\";Col_A=\"ID_A\",Col_B=\"log 1\",Col_C=\"yes\";Col_A=\"ID_A\",Col_B=\"log 2\",Col_C=\"no\";Col_A=\"ID_A\",Col_B=\"log 3\",Col_C=\"yes\";Col_A=\"ID_C\",Col_B=\"log 5\",Col_C=\"yes\";" | makemv data delim=";" | mvexpand data | rename data as _raw | KV | table Col_A, Col_B, Col_C | stats count as eventCount first(Col_C) as startsWith list(Col_B) as Col_B list(Col_C) as Col_C by Col_A | search startsWith="yes" | table Col* eventCount I added a log 0 event to the data and ID_A disappeared: ... View more

| reverse | eval _time=now() | transaction Col_A startswith=(Col_C=yes) ... View more

I just encountered the error so it is obviously not resolved yet. ... View more

I downvoted this post because doesn't work ... View more

| rex field=field1 "(?<newfield>\S+)" ... View more

Filter a Field that is ".. null or blank or NaN or something. How do I get those records removed from the results?" ... | regex field1!="^(?:\s*|NaN)$" ... View more

If you don't use filldown (answer below) then the correct answer is streamstats with current=false followed by coalesce. ... View more

|rest /services/authentication/users | search realname=* roles!=app* roles!=index* | dedup title type realname email tz roles | table title type realname email tz roles | rename title as Username realname as "Full name" tz AS "Time zone" email AS "Email address" type AS "Authentication system" ... View more

SEDCMD-domainname = s/(\(\d+\))/./g You had an extra "\" and needed an extra "+" ... View more

SEDCMD doesn't work on the UF ... View more

Both SH and IDX must be set to either encrypt or not. ... View more

The first search of the accepted answer has dashboard formatting in the regex (gt/lt) not conducive to the search line and also could benefit from using the regex command to filter: |rest /servicesNS/-/-/data/ui/views splunk_server=local | regex eai:data="query" | table author eai:acl.app id eai:data title label|rex max_match=0 field=eai:data "\<query\> *(?P<search_used>[^\<]+)\<\/query\>" | search search_used=* | mvexpand search_used followed by: | regex search_used="." | fields - eai:data Where the dot in the regex command is replaced by the fieldname token. While it is crude to search for the name without the field usage format/context, it will work for most cases. More effort to key on field usage context would produce more accurate results. ... View more

jcat54's answer is much better. I learned something big from that answer; wish I had understood that a while ago. Also, you are correct that any comment with an equals sign in it 5 times would initiate an event break right before that line. I neglected the "^" because I suspected that some events might have space characters before the "=". I neglected matching more than 5 because once a match of 5 was complete, the rest didn't matter. ... View more

Anchor on the word "all", props.conf [myst] EXTRACT-field1 = all\s+(\S+\s+){2}(?<field1>[\d\.]+) 195 steps. https://regex101.com/r/l2PGs6/2 Change myst to your sourcetype and field1 to your field name. ... View more