Thanks @ITWhisperer & apologies for delayed response. If I do a search with 'Location:BBB', I won't see the 'Timestamp: Address:BBBBB.....' in search event result. That's why streamstats not working in my case? ... View more

Thanks @ITWhisperer , tried but still it's displaying only the Event matched line. index=main Location:BBB | streamstats list(_raw) as raw first(_raw) as first_raw window=2 | regex first_raw="Location:BBB" | fields - first_raw | mvexpand raw | rename raw as _raw   ... View more

Hi @yuanliu, Generally I'm looking for what we see in the Events -> Event Actions -> Show Source.  I can't do it by _time, because we've multiple host & source which could overlap. Unfortunately so such fields/ keys to identify it.  ... View more

Hi @ITWhisperer , Thanks, but this gives the same matching event, not adding the next immediate line. ... View more

Hi @PickleRick, @richgalloway  Yes, I agree with your statements. I don't want to relate events. Based on the search match events, I want that matched event along with next line. Which we usually see in the Show source. Ex: Timestamp: Location:AAA Timestamp: Address:AAAAA..... Timestamp: Location:BBB Timestamp: Address:BBBBB..... Timestamp: Location:CCC Timestamp: Address:CCCCC..... From the above example, If I search for specific Location='BBB', based on the matched event. I want to display below matched event and it's immediate next line which contains additional information I'm looking for, this can be achieved using regex/ rex patterns. But I'm missing something "rex field=_raw "[^\r|\n\r|\n](?<MatchedPatterns>.*[\r|\n\r|\n]?.*), it's not giving me the exact result I'm looking for, even if there are better solutions I would be happy to know about it. Timestamp: Location:BBB Timestamp: Address:BBBBB..... ... View more

Hi @ITWhisperer , Thanks again!! License usage is not a problem in our case. I just need these to stored in a dedicated path, instead of storing in stash. Is there any article/ links I could refere to, could you please kindly help!! ... View more

Hi @ITWhisperer . Thanks for the info, using same index would be fine just I want it to get written in either a new file in new soucetype or a new log file on same sourcetype. I've checked with our Admins, they're advising to do it application level. So just trying to understand why it's not feasible from splunk. ... View more

Your schedluer runs every 5 mins, it should be Cron - */10 * * * *. If you wish to run every 10 mins. ... View more

Hi @sigma , Replace index and sourcetype!! For your first criteria, it should be something like below: | index=XXX sourcetype=YYY | stats count as MaxCount by status_code, username | where status_code=403 | sort -MaxCount | head 10 | table username Second criteria is not clear, but please check whether below query meets yours. | index=XXX sourcetype=YYY | stats count as MaxCount by status_code, username, object_ref | where status_code=403 | sort -MaxCount | head 10 | table username   ... View more

If the query worked, you can mark it as a solution. It'll will help someone who refers similar thing in future. Cheers!! ... View more

Thanks @ITWhisperer. Working like a charm!! 🙂 ... View more

Hi @ITWhisperer  Thanks for the assistance, let me try to break-down my requirement: I scheduled a report to run */5 * * * * (Every 5 mins), with scheduler window of 2 mins (the scheduler can kick-off the report anytime within this 2 mins window). But irrespective of the time when it gets kicked-off I want to search the index for accurate 5 mins. Lets say the scheduler started at 11:16:32.000 but I want to search in index within time of (earliest 11:10:00.000, latest 11:15:00.000). ... View more

Hi, If your trying to match word 'Error' and it's followed by your Dept then below query would do the trick. | rex field=Logs "Dept\W+(?<Dept>\w+)\W+(?<Status>\w+)" | eval Status=if(match("Error", Status),"Failure","Success") | stats count(eval(Status="Success")) as Success, count(eval(Status="Failure")) as Failure by Dept | eval Total = coalesce(Success, 0) + coalesce(Failure, 0) | table Dept, Success, Failure, Total   ... View more

Hi, Append below lines, hope it'll work. | eval column3 = mvjoin(column3, "|") | table column1, column2, column3 ... View more

Thanks, that done the trick but this is feasible only if the dashboard is in open state. But I want to this to perform even if the dashboard is not in open state. ... View more

Hi @isoutamo, Thank you, but is it possible to schedule the Dashboard every 15 mins to collect data to sourcetype. ... View more

Hi @ITWhisperer , Thanks. Used Tokens and it done the trick. I try to push these results to a summary index, and will keep on doing this only if the event is not already present in summary index but I want to maintain the count of this events as well. It seems impossible to maintain unique event in summary index and keep on updating the count of events. Could you kindly suggest a solution for this please. ... View more

Thanks, working now.!!! ... View more

@ITWhisperer  Based on the source the env values get change, from the results I add a new field as 'env' using rex and then have to use the field value to differentiate the files specific to each env. ... View more