The mvexpand command will split the multi-value fields into separate events.  The problem is doing so breaks the relationships with other multi-value fields.  To work around that, combine the three multi-value fields into a single multi-value field, use mvexpand, then split the fields apart. | rename jsonevent.external_ip as exip | rename aip as agentip | eval external_ip = coalesce(agentip, exip) | stats values(jsonevent.hostname) as Hostnames, values(jsonevent.Username) as Users, values(AppVendor) as Vendors, values(AppName) as Applications, values(AppVersion) as Version by external_ip | eval tuple=mvzip(Hostnames, mvzip(Usernames, mvzip(Vendors, mvzip(Applications, Version)))) | mvexpand tuple | eval tuple=split(tuple, ",") | eval Hostnames=mvindex(tuple, 0), Usernames=mvindex(tuple, 1), Vendors=mvindex(tuple, 2), Applications=mvindex(tuple, 3),Version=mvindex(tuple, 4) ... View more

That is what the stats command does. Use the by keyword to group results based on the values of certain fields. | stats sum(Success) as Success, sum(Failed) as Failed by Application | eval Total=Success + Failed | eval percentage=round(Failed*100/Total, 3)   ... View more

It may be complicated, but I think it's necessary.  Perhaps it could be better, though. Even if the SH did expand the query (and maybe it does) before sending to the peers, that's just a part of what the bundle is used for.  Search-time field extractions and lookups done by the indexers make the query more efficient. ... View more

The first example runs entirely on the Search Head where the lookup definition is available. The second example runs on the indexers, which apparently is unaware of the lookup definition.  Either the app defining the lookup is not installed on the indexers or the lookup file is blocked from the knowledge bundle ([replicationDenyList] in distsearch.conf). ... View more

Contact Splunk Education at education_amer@splunk.com for help with that. ... View more

The REPORT setting is incorrect.  The "REPORT-" keyword identifies this as a report setting and so must be on the left side ("Name").  The name of the transform stanza goes on the right side ("Value"). ... View more

Most of the work of a query is done by the indexers so they need to know as much about the search as possible.  That is what the knowledge bundle is for.  To know what results to return to the SH, the peers need to know the values of the tags, eventtypes, and macros used in the query.  The also need to know which fields to extract and how to extract them.  It's all part of the map/reduce process where the search activity is divided among many peers to make the query faster. Information sent in the bundle does not modify the settings in the indexer.  The bundle supplements the information the peer read from its .conf files.  That supplementary data is not visible to either btool or splunk show. ... View more

The problem appears to stem from missing newlines before the timestamps.  Try these props.conf settings: [sourcetype::_json] SHOULD_LINEMERGE = false LINE_BREAKER = app_context=port_data"([\r\n]*)\d{2}\/\d{2}\/\d{4} ... View more

UFs are independent so it is possible to have different configurations on each.  If the UFs are managed by a Deployment Server, however, you cannot have different props.conf files in the same app.  You would have to create separate apps and put them in different server classes for the UFs to have different props for the same sourcetype. To answer the second part of the question, you *should* be able to put force_local_processing = true in the props.conf file to have the UF perform masking.  Of course, you would also need SEDCMD settings to define the maskings themselves.  I say "should" because I don't have experience with this and the documentation isn't clear about what the UF will do locally. ... View more

Splunk treats "true", "True", "TRUE", and "1" as equivalent to a Boolean True value so all of what you see in the docs is correct.  But the point is well made.  We, however, can do nothing about it.  As @meetmshah suggests, https://ideas.splunk.com is the place to bring this up. ... View more

Assuming you have CLI access, it's easy to do by editing .conf files. Create the new app directory $SPLUNK_HOME/etc/apps/<new app>/default Edit $SPLUNK_HOME/etc/apps/search/local/*.conf Move your custom stanzas from the search app to the corresponding file in the new app. Create the new app directory $SPLUNK_HOME/etc/apps/<new app>/metadata Edit $SPLUNK_HOME/etc/apps/search/metadata/local.meta Move your custom stanzas from the search app to the default.meta file in the new app. Restart the SH and test your KOs. Package the new app and upload it to Splunk Cloud. ... View more

This is something normally handled by Professional Services as part of the migration. You can do it yourself, however.  Break the KOs out of the Search & Reporting app into a custom app.  Then upload the app to Splunk Cloud. ... View more

If it's a single line per event then the standard line breaker ([\r\n]+) should work fine. What settings are you using now and how are they failing you? This Splunk Lantern article may shed some light on the process: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Configuring_new_source_types ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

The "rest" in my answer is an SPL command.  The same REST endpoint can be accessed via port 8089 after the port is enabled. ACS will not get you all of the KOs owned by a user. ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

The stats command can do that, although I'm not sure how it will handle "N/A". | stats avg('Column 4') as "Column 2" by 'Column 1'   ... View more

The distinct_count (dc) function will give the unique values of a field. ErrorCode=4624 user!="*$" | timechart span=1d dc(user) as "Unique Users"     ... View more

Nothing "happens".  It's legitimate for a sourcetype to be present in more than one index.  It may complicate your query, though. ... View more