You can use the search language to update the user provided value before searching. One way to do that would be to use the eval's match command to replace spaces with colons at the beginning of the search: sourcetype=logs_with_MACs [ | stats count | eval dest_mac=replace(dest_mac,"\s",":") | return dest_mac] | stats count by dest_mac revision based on additional information: sourcetype=logs_with_MACs [ | stats count | eval dest_mac=replace(dest_mac,"\s|,|-|_|\.",":") | return dest_mac] | stats count by dest_mac applying to your search... index="dhcp" sourcetype="DhcpLog" [ | stats count | eval MAC=replace("$MAC$","\s|,|-|_|\.",":") | return MAC] | stats first(_time) as first, last(_time) as last range(_time) as range values(DevName) as Device by IPls | convert ctime(first) AS Last_Time ctime(last) AS First_Time | eval Duration=floor(range/3600).":".floor((range%3600)/60).":".((range%3600)%60) | fields - first, last, range ... View more

Splunk may have seen that file before (or thinks it has). Does the file have large headers in it? You can force Splunk to re-index the entire file with the oneshot command. opt/splunk/bin/splunk add oneshot -sourcetype test -index main -source /tmp/some_file.txt NB: This will index the entire file, so lines from the file already in Splunk will be duplicated. ... View more

I think there are several options here as you seem to have variable number of varying fields in each event. One solution is to use a combination of props & transforms definitions to pull out major/high-level extractions on first pass and then pull out additional fields in second pass. You could have a props.conf like this to efficiently break events, extract timestamp, and call the field extraction pieces:: [sipSourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+)\d{4}\.\d{2}\.\d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}\s+\w+\s+\| TIME_PREFIX=^ TIMESTAMP_LOOKAHEAD=28 TIME_FORMAT=%Y.%m.%d %H:%M:%S:%3N %z KV_MODE=none REPORT-field_passes=pass_one, pass_two, pass_three and a corresponding transforms.conf like this to first pull out static known fields (pass_one) and then pull out colon separated values (pass_two) and finally add additional passes against sipFields (extracted in pass_one) to handle anything else [pass_one] REGEX=^(\d{4}\.\d{2}\.\d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}\s+\w+)[\s\|\t]+([^\|\t\n\r]+)[\s\|\t\n\r]+([^\|\t\n\r]+)(.*)? #REGEX=^(\d{4}\.\d{2}\.\d{2}\s+\d{2}:\d{2}:\d{2}:\d{3}\s+\w+)[\s\|\t]+([^\|\t\n\r]+)[\s\|\t]+([^\|\t\n\r]+)(?:[\s\|\t]+)?(.*)? FORMAT=szDateTime::$1 logLevel::$2 logType::$3 sipFields::$4 [pass_two] SOURCE_KEY=sipFields REGEX=([^\:\t\n\r\|\d]+)\:([^\t\n\r\|]+) FORMAT=$1::$2 MV_ADD=true [pass_three] # another iteration for variable number of pipe separated values, etc ... View more

This functionality is not available as of Splunk 4.3. A Splunk instance may either draw from a pool (as a license slave) or it may provide access to a pool (as a license master) but it cannot draw from a pool as a slave and distribute a piece of that pool as a master at the same time: http://docs.splunk.com/Documentation/Splunk/latest/Admin/HowSplunklicensingworks ... View more

I do not know of a way using just stats. If someone else has a solution, I'd love to see it. Otherwise, you can grab a multimodal list with something like this: ... | stats count(EventCode) as count by EventCode | eventstats max(count) as mode_indicator | where count=mode_indicator | mvcombine delim="," EventCode | fields mode ... View more