Also, in the first search adapterid= is missing the * ... View more

Thanks a lot for this, it worked fine for me! ... View more

Go to the CLI and try a splunk bool props list MTR and see what value is set there, please. ... View more

As written in my answer above - your regexes are still missing a capture group name, so Splunk doesn't know which field these matches should be extracted too 😉 ... View more

Hey, SHOULD_LINEMERGE = [true|false] * When set to true, Splunk combines several lines of data into a single multi-line event, based on the following configuration attributes. * Defaults to true. If you set that to false for your sourcetype, every line will be one event. Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Ah, doom. Some commands fail when you have fields with dots, or other stuff inside, so you might want to try to put that message.time in " or ' - maybe that helps. ... View more

The only thing that comes to my mind, that would be easy to test, to try to copy the _indextime field to the _time field. _indextime always exists, is extracted at index time, and I've done this often, if that also doesn't work it would be a good indicator. So, give it a try, replace message.time with _indextime. ... View more

Yeah, it should work, this document says the same. Just thought to make it explicit (as in, create as an extracted field with regex, just to make sure). Also, you said you tried this: sourcetype="my_source_type" | eval _time=message.time | eval timetest=_time | dedup message.userId | table _time, timetest, message.time Try this: sourcetype="my_source_type" | eval oldtime=_time | eval _time=message.time | eval timetest=_time | dedup message.userId | table oldtime, _time, timetest, message.time Is _time showing the same timestamp as oldtime? If yes, it somehow didn't get overwritten by message.time... ... View more

Thanks for pointing this out, the XML field extraction/performance issue is something I didn't have in mind, and yeah, they're pretty dense, so that would most likely be a problem. 🙂 I'll steal your regexes, because I thought of doing those, too. 🙂 ... View more

Did you take a look at the splunkd.log? It should be in $yourinstallfolder/var/log/splunk/. If you can't find it or there is zero information in it from the time you tried to start it, you are most likely looking at a permissions issue... ... View more

Just to make sure - it begins with <p> and ends with </p> , right? ... View more

Try making this an explicetely extracted field - at the moment you're using KV_MODE to do this, right? ... View more

Did you take a look at the splunkd.log for any warnings, errors, etc? ... View more

Login where? Your Splunk instance? splunk.com? ... View more

Hey, You should be able to use the timestamp as it is, because it has to be an epoch timestamp. Did you check if there is maybe any excess data in that field, like spaces, " or ' or something like this? Don't be confused about being unable to see _time - fields starting with _ are invisible by default, you could do a second eval like | eval timetest=_time to see if it actually worked, just in case. However, that should work fine, because timechart operates on _time by default... ... View more

Yeah, I thought it might be useful to have a comparison handy, but that might actually be enough 😉 ... View more

You only provided little detail, so you'll have to adapt this to your data: index=yourindex sourcetype=yoursourcetype | timechart span=1mon max(yourfield) by host Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂 ... View more

Please add some details: Do you already have that data? Is it Windows, Linux.... like, basics. 😉 ... View more

From the docs: Specifies whether to use the prestats format. The prestats format is a Splunk internal format that is designed to be consumed by commands that generate aggregate calculations. When using the prestats format you can pipe the data into the chart, stats, or timechart commands, which are designed to accept the prestats format. When prestats=true, AS instructions are not relevant. The field names for the aggregates are determined by the command that consumes the prestats format and produces the aggregate output. I understood it as it is required for timechart etc. to properly work on tstats data, and at least once had trouble when not using it, because the output was wrong. Maybe it's only needed if you use specific features of timechart? Just wanted to mention it exists, in case you run into trouble when not using it 🙂 ... View more

You might need to add prestats=true right after tstats, don't you? ... View more

Can you elaborate on "not able to access"? Do you get a timeout? A connection reset? A HTTP error? Can you also show the actual URL you're trying to access? ... View more