Yes the lookup table worked. Thank you. Here is the reason I ask. I am trying to combine that search along with some other stuff to create a dashboard with. I got it working, just evaluating it now: | inputlookup channel.csv| eval count=0, Channel=lower(Channel)| append [ search index=java host=*myhost* "PLACEORDER_API_UNSUCCESSFUL" orderSourceId=7 OR orderSourceId=6 OR orderSourceId=5 | eval Channel=lower(Channel) | stats count AS Failure BY Channel]| stats sum(count) AS Failure BY Channel | appendcols [search index=java host=*myhost* "PLACEORDER_API_SUCCESSFUL" orderSourceId=7 OR orderSourceId=6 OR orderSourceId=5 | eval Channel=case(orderSourceId == 7, "Desktop", orderSourceId == 6, "Andriod", orderSourceId == 5, "iOS") |stats count as Success by Channel]| appendcols [search (index=java host=*myhost* "Request received for placeOrder") OR (index=java host=*myhost* "PLACEORDER_API_REQUEST" orderSourceId=*) | transaction cartId maxspan=5sec| eval Channel=case(orderSourceId == 7, "Desktop", orderSourceId == 6, "Andriod", orderSourceId == 5, "iOS") | stats count by Channel] | eval Success_Percentage=(Success/(Success+Failure))*100 | table Channel Success Failure Success_Percentage ... View more

No meaning if I remove the BY clause and run it with the fillnull command at the end it works fine: index=java host=*myhost* "PLACEORDER_API_UNSUCCESSFUL" orderSourceId=7 OR orderSourceId=6 OR orderSourceId=5 | eval Channel=case(orderSourceId == 7, "Desktop", orderSourceId == 6, "Andriod", orderSourceId == 5, "iOS") | stats count AS Failure | fillnull value=NULL` ... View more

I am accepting this answer because it IS the correct answer........BUT its not a good resolution, not that I expect anyone to fix it. How is it that Splunk cannot see these users via the GUI but it still sees these users artifacts in their directories. ... View more

Ahhh had some side help, removed the stats count by gateway result and got it working thanks! ... View more

Well MOSTLY. When this is run it returns a count of 1 for each gateway_result because | chart count by gateway_result is only counting 1 record of each for some reason. ... View more

Beautiful, I KNEW it was something simple I was not thinking about. Just didn't eval the results together. Thanks a bunch! ... View more

Yes this worked, case definitely worked here, thanks! ... View more

Just FYI the formatting isn't quite right here but the second search I listed here is straight from the doc you added: http://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API ... View more

So via the GUI there is NOTHING for this user NOR is the search tied to them found. It IS however in the file system which is why it keeps throwing the abandoned search messages. I am the admin I cant put it all here as it specific to my place of business but heres MOST of it: curl -k -u uname:pass <host>:8089/servicesNS/kmothenkani/stubhub_dashboard/saved/searches/SFR-PDF%20APIs/acl -d owner=tkwaller -d sharing=user Also tried: ./splunk search "| rest splunk_server=local /servicesNS/-/-/saved/searches | table eai:acl.sharing eai:acl.owner id | rename eai:acl.owner as owner eai:acl.sharing AS sharing | search owner=kmothekani" Your session is invalid. Please login. Splunk username: admin Password: ... View more

The problem is still the same. It says the user doesn't exist. Because they do not exist BUT their user path DOES exist via the File System. So I cannot remove anything via the GUI as there's nothing to remove and I can't do it via REST for the same reason. So the question remains: how do I do this properly in a large clustered environment, we have 34 search heads what would be the effect of rm -rf SPLUNKHOME/etc/users/<user_no_longer_here> Would that work? Would that replicate to the other SH's? If the saved search goes away it's fine, I can re-crate it ... View more

yes the <user_context> is the old user, the error is for the OLD user, as that user no longer exists but DOES exist in the FS. The user doesn't exist via splunk web nor does the savedsearch but I CAN find it in SPLUNKHOME/etc/apps/users/<user_context>/ ... View more

The root cause of this was a HWF that also runs as a syslog collector. For some reason the HWF becomes too busy and stops. It is still undetermined HOW this 1 HWF could stop the entire flow of data through the entire environment though, as there are many others that should have taken over. For now the issue is fixed ... View more

This has intermittently been ongoing for MONTHS since installing 6.4.1 on Splunk Admin servers, search heads, HWFs and indexers. ... View more

Also just FYI the UFs are are running Linux on Splunk 6.3.3 but upgrading has no affect on this issue All other servers including Splunk HWFs and Indexers are 6.4.3 ... View more

It appears that the extraction is only partly working. For some addresses it works and others it does not but I have not found WHY as the addresses it works on are the same format that it does not ... View more

If this log is not returned then there won't be a user field ... View more

Unfortunately I get the same results ... View more