Hi @nsantiago17 , Some sample data would be helpful, along with how you would like to the report/table to look. Some questions: What is TNeg_eqt? What is TNeg_drv? What is the unique value for these events (transaction ID, line number, serial number, etc)? Why are you using dedup? I would use something like this: ( index=BI_1 sourcetype=jobs_info fieldJ IN (Flamengo) ) OR ( index=BI_2 sourcetype=tel_drv ) | eventstats sum(TNeg_eqt) as TNeg_eqtSum sum(TNeg_drv) as TNeg_drvSum This search will show the sum of each value as an additional field. If you just want the total sum and no other information, you could use stats: ( index=BI_1 sourcetype=jobs_info fieldJ IN (Flamengo) ) OR ( index=BI_2 sourcetype=tel_drv ) | stats sum(TNeg_eqt) as TNeg_eqtSum sum(TNeg_drv) as TNeg_drvSum If the fields are named differently between indexes, you would use an eval to create the regular field: ( index=BI_1 sourcetype=jobs_info fieldJ IN (Flamengo) ) OR ( index=BI_2 sourcetype=tel_drv ) | eval TNeg_eqt = case(index=="BI_1", TNeg_eqt_BI_1, index=="BI_2", neg_BI_2) | eval TNeg_drv = case(index=="BI_1", TNeg_drv_BI_1, index=="BI_2", drv_BI_2) | stats sum(TNeg_eqt) as TNeg_eqtSum sum(TNeg_drv) as TNeg_drvSum Without knowing more about your data, it's hard to provide an accurate answer. Also, when you do a | stats sum(x) by _time you're usually only going to end up with the same number in the stats calculation because _time will most likely be unique, unless you're using bucket or bin . ... View more

Hi @amunag439 , Your ideal world search will probably work if you take the code="OPEN" OR code="SENT" out of the initial search: host=host" source="source" | transaction traceId startswith=OPEN endswith=SENT | table duration _time traceId or you could adjust it to work for your data (as long as tradeId is extracted properly): host=host" source="source" "OPEN*" OR "SENT*" | transaction traceId startswith=OPEN endswith=SENT | table duration _time traceId ... View more

Hi @tjago11 , As @richgalloway mentioned, securing _audit will not be enough. You would also have to secure _internal. Even if you follow his recommendation to not forward the internal & _audit logs from the ES search head, the indexers themselves will store a copy of the searches run in _THEIR _internal Splunk logs. Other than completely locking down _internal & _audit, there is no easy way to do this. Options to consider might be: - Search restrictions - Scripted authentication. Using scripted authentication, you can create a level of granularity with permissions and search restrictions that prevent people from seeing certain types of data (ie: logs from _internal & _audit on the ES host AND the _internal logs on indexers that pertain to searches from ES hosts). This is complicated and not easy to setup, but it is a way to accomplish what you want to do. ... View more

Hi @ddrillic , I would recommend against doing this. It's bad logging policy, and it leads to problems on the operating system over time if you have to manage groups of log files that constantly grow in number. My first option would be to pre-process these log files. You could setup a system cron job that merges these log files into a single log file, and then arranges the data so that it shows up as an individual event. However, if your hands are tied, you can always set your line breaker up so that it looks for the end of log entry: LINE_BREAKER = ([\r\n]+\*+\s+END\s+OF\s+LOG\s+\*+) SHOULD_LINEMERGE = false You would do this in props.conf for the sourcetype you need this to happen on. https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Propsconf ... View more

Hi @jerrytao , The easiest way to do this would be to use a join command: index=cosv2 ul-ctx-source=c4rupgrd source="FunctionHandler@*" "ul-ctx-caller-span-id"!=null "ul-log-data.function"="GetRemainingAsync" OR "ul-log-data.http_url"="https://string/validatetoken" | join ul-ctx-head-span-id [ search index=cosv2 ul-ctx-source=c4rupgrd source="FunctionHandler@*" "ul-ctx-caller-span-id"=null "ul-log-data.http_url"!="*/health" "ul-log-data.http_url" IN ("https://string/queries*", "https://string/jobs*") ] | rename ul-log-data.* as * | replace ... put your replace stuff here ... | eval function = tostring(function) . "___" . tostring(http_url) | table _time ul-ctx-head-span-id http_url function ul-span-duration Try that and see if you get the results you're looking for. Edit: Another way to accomplish this: (index=cosv2 ul-ctx-source=c4rupgrd source="FunctionHandler@*") ( ("ul-ctx-caller-span-id"=null) OR ("ul-ctx-caller-span-id"!=null "ul-log-data.method"="*") ) | eval func_dur = 'ul-log-data.function' . "|" . 'ul-span-duration' | stats values(ul-log-data.method) as ul-log-data.method values(func_dur) as func_dur by ul-ctx-head-span-id | mvexpand func_dur | eval ul-log-data.function = mvindex(split(func_dur, "|"), 0), ul-span-duration = mvindex(split(func_dur, "|"), 1) | table ul-ctx-head-span-id ul-log-data.method ul-log-data.function ul-span-duration ... View more

Hi @johnjonatan319 , Here are things to check for troubleshooting: - Do you receive events from that host for the _internal index? If not, then you probably do not have the forward setup to send data to SplunkCloud correctly: https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/User/DataSplunkCloudcanindex Instead of writing to STDOUT, write to a file on disk, and then configure the forwarder to watch that file If this works, then it would be an issue with the way the app is processing STDOUT information. Maybe writing to disk would be a better option for troubleshooting and providing the ability to re-ingest missed events in the case of a network issue/error. Let me know if this helps. ... View more