Hi @joshiro,  Apologies for the delay in replying.  The issue looks to have stopped and I have my suspicions that something was changed on the DB server (quite recently) as nothing has changed from a Splunk POV.  What has changed I couldn't tell you.  If I do uncover it, I'll update here. The only thing I could suggest if updating your version of the app.  I couldn't get 3.10 to work, so stuck with 3.9.0. Sorry it's not a fix.   Steve ... View more

Thanks @tscroggins I see there is an update to db connect.  I will get that done and see what happens 🙂 ... View more

We're running 8.1.3 currently. ... View more

Hi Richard,  The regex is defined in transforms and called by props. Apologies, that would be useful 🙂 Added to the top ... View more

HI Rich,  Thanks for the response.  I had already done that, works in reg101 but not in splunk I've also come up with (?:([\w+]+)=(?:\")(.+?)(?:\",\s|\"$)) which does exactly what I want on reg101 , but again doesn't work the same in Splunk. ... View more

Hey, Thanks for the suggestion 🙂  Unfortunately it doesn't work 😞  I had to remove the OR X and AND X from the searchmatch and then it just returned the same results as the original.  Appreciated though. ... View more

Will do 🙂   ... View more

OK, I fixed the field extractions by converting to indextime rather than searchtime.  However, any searchtime functions eg calculated fields are still being ignored by the 2 searchheads.  I'll keep digging. ... View more

Hi Soutamo,  We don't run a multisite due to its scale and function.  So I have the deployer and a search head in one location and then 2 search heads in the other location.  These are then setup behind a load balancer which will fail to the single searchhead should the primary location fail. ... View more

Hi Nisha,  Thanks for the query.. this is the output on both a working and non-working searchhead. id = https://127.0.0.1:8089/servicesNS/nobody/app_name/configs/conf-props/sourcetype title = sourcetype updated = 1970-01-01T01:00:00+01:00 disabled = false ADD_EXTRA_TIME_FIELDS = true ANNOTATE_PUNCT = true AUTO_KV_JSON = true BREAK_ONLY_BEFORE_DATE = true CHARSET = UTF-8 DATETIME_CONFIG = /etc/datetime.xml DEPTH_LIMIT = 1000 EVAL-duration = hour * 3600 + minute * 60 + second + precise/10000000 EXTRACT-fields = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \[\d+\] \[(?P<ClientIP>[^ ]*) \(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\)\] INFO\s+(?P<GingerClass>[^ ]*) - Start: (?P<JobStartTime>[^;]*);Reseller:\s(?P<ResellerName>[^;]*);ResellerUnit: (?P<ResellerUnit>[^;]*);(?P<JobGUID>[^;]*);(?P<UserGUID>[^;]*)?;(?P<ApiMethod>[^;]*);Duration: (?P<hour>[^:]\d+):(?P<minute>[^:]\d+):(?P<second>[^\.]\d+)\.(?P<precise>[^;]\d+);(?P<RegOutcome>[^;]*)?;(?P<FailReason>[^$]*)? LEARN_MODEL = true LEARN_SOURCETYPE = true LINE_BREAKER_LOOKBEHIND = 100 MATCH_LIMIT = 100000 MAX_DAYS_AGO = 2000 MAX_DAYS_HENCE = 2 MAX_DIFF_SECS_AGO = 3600 MAX_DIFF_SECS_HENCE = 604800 MAX_EVENTS = 256 MAX_TIMESTAMP_LOOKAHEAD = 128 SHOULD_LINEMERGE = true TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N TIME_PREFIX = ^ TRUNCATE = 10000 app = app_name author = nobody detect_trailing_nulls = false maxDist = 100 splunk_server = searchhead1  The actual props.conf is: [sourcetype] TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S,%3N EXTRACT-fields = \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2},\d{3} \[\d+\] \[(?P<ClientIP>[^ ]*) \(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\)\] INFO\s+(?P<GingerClass>[^ ]*) - Start: (?P<JobStartTime>[^;]*);Reseller:\s(?P<ResellerName>[^;]*);ResellerUnit: (?P<ResellerUnit>[^;]*);(?P<JobGUID>[^;]*);(?P<UserGUID>[^;]*)?;(?P<ApiMethod>[^;]*);Duration: (?P<hour>[^:]\d+):(?P<minute>[^:]\d+):(?P<second>[^\.]\d+)\.(?P<precise>[^;]\d+);(?P<RegOutcome>[^;]*)?;(?P<FailReason>[^$]*)? EVAL-duration = hour * 3600 + minute * 60 + second + precise/10000000 ... View more