Can you paste the actual warning? ... View more

How is field1 defined? Is it a custom extraction you put in place? Is it shared globally? Is the account you're using to log in to SplunkWeb the same account you're using for the python script? I put your code into a python script and it seems to work just fine (I removed the timeframe from the search string for mine): search_text = "search source=source1 field1=*" job = service.jobs.create(search_text) while True: while not job.is_ready(): pass stats = {"isDone": job["isDone"], "doneProgress": float(job["doneProgress"])*100, "scanCount": int(job["scanCount"]), "eventCount": int(job["eventCount"]), "resultCount": int(job["resultCount"])} status = ("\r%(doneProgress)03.1f%% %(scanCount)d scanned " "%(eventCount)d matched %(resultCount)d results") % stats sys.stdout.write(status) sys.stdout.flush() if stats["isDone"] == "1": sys.stdout.write("\n\nDone!\n\n") break sleep(2) ... View more

Unless I'm missing something, count(eval(Proxy)) could be more simply written count(Proxy) , which will give the count of values in the Proxy field. ... View more

Don't forget to accept the answer if you consider it correct and helpful. ... View more

I certainly would have expected B =bytes, b =bits, but the paste from the docs suggests otherwise. ... View more

I, too, hope my answer proves to be wrong. 🙂 ... View more

There is no way to run code at index time once the event is presented to Splunk. So, monitor inputs, etc have no way to do this. But, if the necessity to accomplish this exists, you can look into scripted or modular inputs to meet this need. Basically you would write code that reads the file and does the replacement, and Splunk would call that code. ... View more

One thing you want to be very careful with is making sure you get your frozenTimePeriodInSecs and maxTotalDataSizeMB correct before you point splunk at an existing index location. If either is wrong you risk splunk thinking data needs to be frozen (which really means deleted in most cases). ... View more

Is this a standalone splunk instance (or are you trying to search directly from the instance that has the data mounted)? Can you post the output of splunk btool indexes list --debug ? ... View more

If the answer solved your issue, please accept it so the question looks resolved. ... View more

Yup, that’s a better way to parse delimited fields long term. I honestly can’t imagine splitting by spaces is going to work for web logs, though. What about useragents? ... View more

mvindex http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/CommonEvalFunctions ... View more

Though technically this is an answer regarding "how do I get this data I need," instead of "why didn't this work, and how would I make it work?" 😉 ... View more

Nice workaround! ... View more

| eval allfields=_raw | makemv allfields This may not work will for your specific use case, but it will split into as many values as it needs. delim defaults to , so I left it out of the command. https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Makemv ... View more

The way you would do this is to have your drilldown craft a search for the fields that were summarized in your summary data, including time range and any field key/value pairs summarized in the event clicked on. There is no way to definitively fetch the exact events that went into summary data. ... View more

| sort _time isn't really a solution. It's more of a method of showing that the issue is present and helps explain why. The real solution is to upgrade to 6.6.4 as soon as you can. This isn't the only issue resolved in 6.6.4 that I've run into. ... View more

Realizing the full issue isn't solved, if you think the answer posted accurately answered the question posted, please accept it so this question no longer looks open. ... View more

Ahhh, it sounds like your license master isn't forwarding its logs to your indexers. This would definitely result in what you are seeing. I highly recommend putting that forwarding in place. If you run this on your license master you'll likely see no forwarders defined: splunk list forward-server ... View more

Your source isn't license_usage.log , but it can be matched with *license_usage.log : index=_internal source=*license_usage.log type="Usage" splunk_server=* idx=oracle earliest=-1w@d | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by st, Date | eval MB=round(volume/1024/1024,5) | timechart first(MB) AS volume by st This worked for me, removing the splunk_server, idx filters: index=_internal source=*license_usage.log type="Usage" | eval Date=strftime(_time, "%Y/%m/%d") | eventstats sum(b) as volume by st, Date | eval MB=round(volume/1024/1024,5) | timechart first(MB) AS volume by st ... View more

Is it possible that the metrics intervals don't line up? Maybe there is only one kb value every 10 minutes, but kbps every minute? ... View more

You're right, according to that _tcp_KBps is indeed kilobytes per second. ... View more

There is certainly nothing in there that I'd expect to be causing this. Can you also send the inputs.conf responsible for this data? ... View more