Thank you @richgalloway and @bowesmana . That worked. ... View more

To do this properly, you should transform this garbage into fully-compliant JSON (that means removing ALL whitesapce) BEFORE it is indexed. This will save you license and allow KV_MODE=json to "just work". ... View more

Appreciate your help on responding to my question. But as I am pretty new to this, I am not clear on what does it mean by MC. I am not sure if that was done by our Admins. I am not sure if I am an admin. Is there any other way to find out the disk usage other than the introspection? ... View more

I tried the same query but still it does not give the greater values. I tried the other option suggested by other splunk user and adding the below after what you gave. |stats list(ElapsTime) as ElapsTime, list(above_average) as above_average values(AVGResponse) as AVGResponse by sPath Thank you for your help Thanks Koti ... View more

Like this: props.conf: [YourSourcetypeHere] TRANSFORMS-ThisNameIsArbitraryButShouldBeUnique = commalist transforms.conf: [commalist] DELIMS = "," FIELDS = field1, field2, field3 ... View more

This worked. Thank you for your inputs. ... View more

This is good if you're typing manual search results, but is it possible to auto-extract KV's from JSON once you've cleanly extracted the JSON into it's own field? The raw events aren't ONLY JSON, and I want auto-extractions to occur against a particular field in all search cases, not only those with the spath command piped. Am I dreaming? ... View more