@wralph_EPACN please accept an answer if it solved/helped it and upvote it. Otherwise let us know how can we help further ... View more

@johnny_goya please accept an answer if it solved/helped it and upvote it. Otherwise let us know how can we help further ... View more

@Rob2520 please accept an answer if it solved/helped it and upvote it. Otherwise let us know how can we help further ... View more

@mstjohn_splunk no worries, it's done 😉 ... View more

If there is no header field on the search result I guess there is no fields clientHeaders.test with a suffix. Check this dummy example, where only one field called header is created, which seems to not have much logic when framing this with the foreach command | makeresults | eval clientHeaders.test1=1, clientHeaders.test2=2 | foreach clientHeaders.test* [eval header='<<FIELD>>'] If you want a field header_ for each of the clientHeaders.test, you can use | makeresults | eval clientHeaders.test1=1, clientHeaders.test2=2 | foreach clientHeaders.test* [eval header_<<MATCHSTR>>=<<FIELD>>'] In my opinion it doesn't seem to be what you want to achieve from what I get from your query. Would you put here an anonymyzed example of existing fields at this point: | multisearch [ search gateway_wmf(ClientRequest) path=vat] [ search wso2_wmf(RequestCompleted) "request.detail.apiContext"=*test] | eval RequestID=coalesce('request.tags.X-Request-ID','requestID') | dedup eventId | rename request.detail.applicationProductionClientId as ClientID response.detail.statusCode AS statusCode And get us what you want to get in the end? ... View more

@ramesh12345 don't forget to upvote and accept the answer. This thread has been long and other questions arose. Upvote the useful comments please ... View more

index="os" sourcetype="Service" status=* (Group="Data/Config" OR Group="Secure") AND (Section="Site Problem" OR Section="Local health") AND (Component="connectivity" OR Component="health") | eval NewGroup=if(Group="Data/Config", "Secure", Group) | eval days = (now() - strptime(_time,"%Y-%m-%d %H:%M:%S"))/86400 | eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day") | eventstats last(Group) as LatestGroup by CaseNumber | chart count by days_ago,LatestGroup | sort days_ago ... View more

| dbxquery query="SELECT COUNT(*) FROM <table>" connection="<yourconnection>" ... View more

I don't see the point of | where Created_ON=Updated_ON. If they are tickets, this is probably true only at creation time, so I took it off on the search. This will give you the latest value of Group per CaseNumber. You mentioned it starts as Data/Config but then changed to Secure, so while a case number has only Data/Config, it will remain like that. If there is both Data/COnfig and later Secure for a case number, then it will keep Secure. | makeresults | eval Created_ON="2019-02-27 12:00:00", Updated_ON="2019-02-27 12:00:00", CaseNumber=1, Group="Data/Config", Section="Site Problem",Component="health", _time=Updated_ON | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=2, Group="Data/Config" , Section="Site Problem",Component="health", _time=Updated_ON ] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=3, Group="Data/Config", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=4, Group="Data/Config", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 15:30:00", CaseNumber=2, Group="Secure", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=6, Group="Secure", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=4, Group="Secure", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=77, Group="Secure", Section="Site Problem",Component="health", _time=Updated_ON] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=22, Group="Secure", Section="Site Problem",Component="health", _time=Updated_ON] | eval NewGroup=if(Group="Data/Config", "Secure", Group) | eval days = (now() - strptime(_time,"%Y-%m-%d %H:%M:%S"))/86400 | eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day") | eventstats last(Group) as LatestGroup by CaseNumber | chart count by days_ago,LatestGroup | sort days_ago ... View more

Run this search, it's a dummy one, you can run it everywhere, and tell me if this is the scenario you are seeing before chart: | makeresults | eval Created_ON="2019-02-27 12:00:00", Updated_ON="2019-02-27 12:00:00", CaseNumber=1, Group="Data/Config", Section="Site Problem",Component="health" | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=2, Group="Data/Config" , Section="Site Problem",Component="health" ] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=3, Group="Data/Config", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=4, Group="Data/Config", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=2, Group="Secure", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=6, Group="Secure", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=4, Group="Secure", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=77, Group="Secure", Section="Site Problem",Component="health"] | append [| makeresults | eval Created_ON="2019-02-27 14:30:00", Updated_ON="2019-02-27 14:30:00", CaseNumber=22, Group="Secure", Section="Site Problem",Component="health"] | where Created_ON=Updated_ON | eval NewGroup=if(Group="Data/Config", "Secure", Group) | eval days = (Now() - _time) /86400 | eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day") ... View more

Final query? Is that it? index="os" sourcetype="Service" status=* (Group="Data/Config" OR Group="Secure") AND (Section="Site Problem" OR Section="Local health") AND (Component="connectivity" OR Component="health") | dedup _time | where Created_ON=Updated_ON | eval NewGroup=if(Group="Data/Config", "Secure", Group) | eval days = (Now() - _time) /86400 | eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day") | chart count by days_ago,NewGroup |sort days_ago ... View more

If your Monitoring Console is not a SearchHead of the Indexer Cluster, you'll need to add the indexers to the MC as search peers anyway. If MC is a search head of the Indexer Cluster, it will automatically be searching the indexers and you don't need to add them ... View more

I'm not sure how could you have that information without having the indexers as search peers of the MC to be honest ... View more

Here is what you should have: SHOULD_LINEMERGE=true LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true TIME_PREFIX=expireTime=\w{3}\s TIME_FORMAT=%b %d %H:%M:%S %Z %Y MAX_TIMESTAMP_LOOKAHEAD=24 Let me know ... View more

Good work narrowing this down. If the info was there and is not visible anymore: retention policy (you already mentioned it is not the cause) someone changed your searcheable indexes for your role? someone changed the searcheable terms for the role, avoiding you to find those? has someone deleted those events? (check _audit for delete commands both on the origin index and notable) could that event have had a weird timestamp and timezone and be in a different time from what you are searching now? ... View more

If there is no header field on the search result I guess there is no fields clientHeaders.test with a suffix. Check this dummy example, where only one field called header is created, which seems to not have much logic when framing this with the foreach command | makeresults | eval clientHeaders.test1=1, clientHeaders.test2=2 | foreach clientHeaders.test* [eval header='<>'] If you want a field header_ for each of the clientHeaders.test, you can use | makeresults | eval clientHeaders.test1=1, clientHeaders.test2=2 | foreach clientHeaders.test* [eval header_<>='<>'] In my opinion it doesn't seem to be what you want to achieve from what I get from your query. Would you put here an anonymyzed example of existing fields at this point: | multisearch [ search gateway_wmf(ClientRequest) path=vat] [ search wso2_wmf(RequestCompleted) "request.detail.apiContext"=*test] | eval RequestID=coalesce('request.tags.X-Request-ID','requestID') | dedup eventId | rename request.detail.applicationProductionClientId as ClientID response.detail.statusCode AS statusCode And get us what you want to get in the end? ... View more

Access your instance ( expecting it to be a nix machine) and go check the directory owner, group and rwx permissions. Make sure splunk user is the owner and the owner has rwx on the directory and subcontents. ... View more

Go with splunk offline --enforce-counts. Used to remove a peer permanently from the cluster. Also known as the "enforce-counts offline" command. http://docs.splunk.com/Documentation/Splunk/6.6.3 /Indexer/Takeapeeroffline. it will get you the cluster in a valid state on the process. Remember you're moving to 1 Indexer only, you need to change the RF to 1 otherwise it won't be valid after you finish the decommission. SF will be fine as long as you bring the peers offline one at a time as the buckets will be copied to the last one standing, no need to rebuild or make them searchable again After that you can remove the peer from the cluster as you mentioned ... View more

Can you check the retention policy in your notable index ? ... View more

This search shows a count of 0 for pairs (sourcetype,index) that don't have any value. Adding the dc(host) will get your fourth column. Value mismatch on the count? tstats count by index,sourcetype can't be wrong, this runs tstats count by index,sourcetype , how can it be right for some and wrong for others? ... View more