I think you have a units mismatch. Kbps is kilo-bits per second. kb is kilobytes (with no rate). ... View more

Will you add the output of: splunk btool props list _json --debug (From your screenshot it looks like the sourcetype is _json ) ... View more

Are you seeing those messages in search.log? ... View more

Check the output of splunk list monitor to see if the file somehow shows up twice. ... View more

Maybe: | eval process_cpu=if(counter="% Processor Time", Value, NULL), Value=if(counter="% Processor Time", NULL, Value) ... View more

Hopefully we'll both get to go and enjoy some beverages! It's basically this month or bust for me. They'll put me back to work next month, so I won't have nearly as much time to post on answers. ... View more

Your double quotes came across wrong. | rex field=_raw "user\s(?<user>[^\/]+)" ... View more

While using the collect command to change the timestamp, consider the discussion on this recent answers post. It doesn't seem as simple as setting a new _time value before piping to collect . ... View more

Does this search take a long time to run? ... View more

Actually this seems closer to what was asked for. At first I was thinking it was asked to separate the -2fa from the rest of the username, but at second glance that doesn’t appear to be the case. ... View more

You could also download the same splunk version tarball and untar it over the existing installation. This is a valid upgrade method, so it is not considered harmful. It would restore all your default settings and files back to the originals. You need to consider if this would have any unintended side effects: are you relying on any of the values changed in the default configs. If so, you need to move them to local. ... View more

Timestamps aren't a function of the index, they are a function of the sourcetype. Do you want to index different event formats with different time formats? ... View more

Are you sure the duplicate RefGUIDs are incorrect? That would make it sound like events were indexed twice, instead of parsed twice. And the Condition may not necessarily be wrong either. Do you see a single event that has the Condition value in the JSON but not parsed out by splunk? ... View more

Run anywhere example: | makeresults | eval _raw="Jan 9 07:35:16 192.168.1.254 firewall001: NetScreen device_id=firewall001 [Root]system-warning-00515: Admin user jdoe-2fa/904744 has logged on via SSH from 192.168.1.100:53429 (2018-01-09 15:35:15)" | rex "user (?<full_user>(?<no_2fa_user>[^\/]+?)(-2fa)?)\/" ... View more

Can you rephrase the question? It's unclear (at least to me) what it is you're asking. ... View more

Can you add --debug to your btool command and paste the results? I love that you've included btool results every time, but it would also be nice if that output showed which file was responsible for each line (basically, it shows which lines you've added to props, and which are still default). This appears to be working flawlessly on my test setup, but, your original post suggested it happened only on a small set of events, and I'm not sure I'm testing events which show that behavior. ... View more

That looks right at first glance. You may want to run: splunk btool outputs list --debug just to make sure it is actually taking precedence, but I can't imagine it's not. And I have to ask, did you restart splunk on this forwarder? ... View more

How was the top table created? Being in that format definitely complicates your search, so if you instead have access to the data used to create that table it may be easier to start with the raw data instead. Also, please include these samples in text form, not screenshots. It's very difficult to work with sample data when you have to manually enter it in. ... View more

It's tough to do without knowing what your initial macro expands to. Can you expand that, and also show sample events from each index/sourcetype/whatever and note how they are related to each other. ... View more

No, you do not. If this works for you, please accept the answer so this question no longer looks open. Obviously ignore that advice if this answer doesn't fully solve your problem. ... View more

Is there a reason you wouldn't want to search for all the events in one search, then perform eval as necessary to normalize field names, then use stats to get the values you need grouped by product_name ? ... View more

Sounds like something you'd see when attempting the windows install, but @mayurr98's question is still valid: did you try this as the admin user (irrespective of which OS it is)? ... View more

Can you post a sample log that breaks incorrectly when you try to index it? You can redact it as necessary, but make sure you've tried to index it and it breaks incorrectly for you (specifically for the sample data you paste). ... View more

I think you just need to add single quotes around your SM_C.key in your eval. This run anywhere search shows the concept working: | makeresults | append [| makeresults | eval sensor="sensor1", _time=1000, SM_C.key="RoomMonitor.Occupied"] | append [| makeresults | eval sensor="sensor2", _time=995, SM_C.key="RoomMonitor.Occupied"] | append [| makeresults | eval sensor="sensor1", _time=993, SM_C.key="RoomMonitor.UnOccupied"] | append [| makeresults | eval sensor="sensor2", _time=993, SM_C.key="RoomMonitor.Occupied"] | streamstats count(eval('SM_C.key'="RoomMonitor.Occupied")) AS occupied_count, count(eval('SM_C.key'="RoomMonitor.UnOccupied")) AS unoccupied_count BY sensor | eval current_occupied_diff=occupied_count-unoccupied_count But keep in mind, also, that streamstats considers events above it (those already returned by the search), which are typically in reverse chronological order. This needs to be considered when you run your streamstats , you may need to reverse things first (but that may be a bad idea if there is a lot of data. ... View more