Hey zacksoft, Try this: | base search table amount, currency , received, time | search received = "1" Let me know if this helps!! ... View more

Hey premranjithj ! The props.conf lives on the indexer,heavy forwarder, and/or search head and this applies "rules" while the data is getting parsed. You can specify how it gets timestamped, the format of the timestamp, how the events should break etc.. So basically, the props.conf will apply your configuration settings to your data while being indexed http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf An example of a stanza in props.conf will look like this [log4j] SHOULD_LINEMERGE=true BREAK_ONLY_BEFORE = ^\$\$\s[A-Z]{5}\s\$\$ TRUNCATE = 30000 MAX_EVENTS = 100000 You can refer this answers link as well: https://answers.splunk.com/answers/119/what-is-role-of-transforms-conf-vs-props-conf-for-field-extraction.html Transforms is used for configuring regex. https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf Hope this helps!! ... View more

Hey Log_wrangler, You can refer to the doc below: http://docs.splunk.com/Documentation/Splunk/7.0.2/Forwarding/Routeandfilterdatad#Discard_specific_events_and_keep_the_rest ... View more

Hi pratibha, What do you mean by node in this case.? If you have a single-instance setup in that case,you need to install Splunk universal forwarder on host from which data has to be monitored and Splunk Enterprise on your splunk server. You can refer docs below: http://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/InstallSplunk http://docs.splunk.com/Documentation/Forwarder/7.0.2/Forwarder/Configuretheuniversalforwarder Hope this helps!!! ... View more