I don't understand the reply.  Did my answer work or not?  If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

We still don't know *how* you are trying to extract fields.  The erex command and the extraction wizard struggle with complex events so consider using one of the commands suggested by @yuanliu . If you only need a few fields, you may have some luck using the rex command to extract them. ... View more

We need more information. How exactly are you trying to extract the fields?  Have you tried any other ways to extract them? Please share a sanitized example event and indicate which fields you wish to extract. ... View more

To graph data over time requires the _time field and a charting command.  Usually, I use timechart, but it only supports a single field so this query uses chart. | tstats count as Requests sum(attributes.ResponseTime) as TotalResponseTime sum(attributes.latencyTime) as TotalatcyTime where index=app-index NOT attributes.uriPath("/", null, "/provider") by _time span=1d | eval TotResTime=TotalResponseTime/Requests, TotlatencyTime=TotalatcyTime/Requests | chart max(TotResTime) as TotResTime, max(TotlatencyTime) as TotlatencyTime over _time ... View more

Putting the queries together is pretty simple, but getting a usable graph from the result is another matter. | tstats count as Requests sum(attributes.ResponseTime) as TotalResponseTime sum(attributes.latencyTime) as TotalatcyTime where index=app-index NOT attributes.uriPath("/", null, "/provider") | eval TotResTime=TotalResponseTime/Requests, TotlatencyTime=TotalatcyTime/Requests | fields TotResTime TotlatencyTime This will produce two single-value fields, which isn't enough for an area chart.  What is it you want to show in the chart? ... View more

Which of the 4 suggestions did you try?  Did none of them help? It would help to have the event in text rather than as an image since it's impossible to put an image in regex101.com for testing.  Try this untested prop [mysourcetype] SEDCMD-noContext = s/Context Information:.*/Context Information:/g ... View more

I think you'll find the contents of the multi-select token are a multi-value field.  That means any place you use $sub_competency$ must make sense with a multi-value field.  Perhaps | search Sub_Competency IN ("$sub_competency$") would work better. As @marnall suggested, it depends on what the token contents look like. ... View more

That event does indeed contain in instanceId field, but the sourcetype may not match the "veeam_vbr_syslog" value expected by the DM.  It's hard to tell from the obscured screenshot. Everything in the "constraints" section of the DM must match your data for it to be found by the DM and appear in the dashboard. ... View more

I see a few issues, but don't know that fixing them will solve the problem. 1. All of the sed commands are malformed.  There should be a single "s/" at the beginning and only 2 slashes before the final 'g'. 2: I'm not sure quotation marks are allowed in a stanza name. 3. "WinEventLog://" is a prefix for inputs.conf stanzas, not for props.conf. 4. Have you tried using a sourcetype name in the props.conf stanza rather than a source name? It would help to see some sample events and to know which parts of the events you wish to remove. If you want someone to confirm the inputs.conf stanza then you'll need to show the inputs.conf stanza. ... View more

It's not that those indexes *should* not be replicated, it's that it's not a big deal if data is lost from them so you can save storage by not replicating them.  If you have a low risk tolerance then feel free to set repFactor = auto for those indexes (it won't hurt anything). ... View more

The specs listed are the *minimums* specified by Splunk.  What the *actual* specs of the DS?  Which version of Splunk is the DS running?  How many apps are in the deployment-apps directory? Splunk does not use /root to store anything and Best Practice is to put $SPLUNK_HOME and $SPLUNK_DB in separate mount points not shared with the OS. Have you run du to see what files/directories are using the most storage? ... View more

The datamodel is looking for specific values in the instanceId field, however, the screenshot does not show an instanceId field exists in the data.  Therefore, the DM will return no results and the dashboard will show nothing. ... View more

Try this variation on the settings.  It should better account for newlines. [custom_json_sourcetype] SHOULD_LINEMERGE = false KV_MODE = json LINE_BREAKER = }(,[\S\s]*){ ... View more

Try removing the quotes from the file path. Check splunkd.log for errors relating to that input. ... View more

Don't use both INDEXED_EXTRACTIONS = JSON and KV_MODE=json in the same stanza or the fields will be extracted twice. The LINE_BREAKER setting requires a capture group.  Try these settings [custom_json_sourcetype] SHOULD_LINEMERGE = false KV_MODE = json LINE_BREAKER = }(,\s*){ ... View more

RF/SF does not apply to SmartStore so the storage usage would be 5TB.  Of the 5TB. the hot buckets would be on the indexers (and replicated) and the rest would be in S2. ... View more

Please post the SPL as text rather than as screen shots. It looks like the first search would become a subsearch within the second search. ... View more

Apps are empty either because the data they need isn't present or because the data can't be found.  You've shown the former is not true so it must be the latter. Confirm the data is in the index(es) where Veeam expects to find it.  If Veeam uses a datamodel (I suspect it does) then your data must be tagged so it is found by the DM.  Look at the DM definition to see which indexes and tags it needs. ... View more

You could try opening a support case to see if they will export your data.  Consider using the REST API to run queries (index=foo earliest=0 latest=now | table *) that return all the data from an index and then save that data in the desired format. ... View more

The underlabel option does not perform evaluations.  Do the eval in a separate statement. <search> <query>index=* EventCode=25753 | stats count(EventCode) as toto | append [| search index=* EventCode=* | stats count(EventCode) as toto2]</query> <earliest>-7d@h</earliest> <latest>now</latest> <done> <condition> <set token="NbHost">$result.toto$</set> <set token="NbHost2">$result.toto2$</set> <eval token="ratio">$NbHost$ / $NbHost2$</eval> </condition> </done> </search> <option name="drilldown">none</option> <option name="underLabel">$ratio$</option> ... View more

This regex will extract the highlighted text (?<msg>"errorMessage":"[^"]+") ... View more

Once a field is renamed the original name no longer exists and cannot be referenced.  All subsequent uses of the field must use the new name. ... View more