Use the top command. This adds  two fields to the results: count  and percent . | top http_status_field_name   Then you can filter based on http_status_field_name and percent. | top http_status_field_name | where http_status_field_name=500 AND percent>30 ... View more

hi @phamxuantung, Fixed the query: | eval ID=if(ORG="MC", substr(ID, -6), ID)   ... View more

What is the issue? Are you getting duplicate data or no data at all? ... View more

Hi @meera, Your  outer search time range will be 7 days and the sub search time range will be last 24 hrs. ... View more

hi @anil1432, Check this answer to export large data: https://community.splunk.com/t5/Getting-Data-In/What-are-my-options-to-export-large-amounts-of-Splunk-data-from/m-p/155323#M31563. ... View more

hi @anil1432, You can check the event count per day is matching in both cases. sourcetype= sourcetypename | bin span=1d _time | stats count by _time ... View more

hi @khaizercruz, Line-breaking configurations should be done before indexing the logs. So, you need to put LINE_BREAKER in forwarder(s). ... View more

hi @sureshwalmart, Official Splunk support for versions 7.0.0 and 7.1.2 is stopped now and for 7.3.0 it will end on 22 October 2021.  You should go for Splunk version >= 8.1. The only thing is python3 is mandatory in Splunk 8.1. So you need to plan to upgrade python scripts in your apps if exists. https://www.splunk.com/en_us/legal/splunk-software-support-policy.html#core But if you still want to upgrade, you can upgrade from 7.0.0 to 7.3.0. ... View more

hi @dtccsundar, This might give you what you asked. | makeresults | eval count_of_true=212, count_of_false=313 | eval count=mvzip(count_of_true, count_of_false), count=split(count, ","), Status=split("true,false", ","), zip=mvzip(Status, count) | mvexpand zip | eval zip=split(zip, ","), Status=mvindex(zip, 0), count=mvindex(zip, 1) | table Status, count   If this reply helps you, a like would be appreciated. ... View more

hi @cheriemilk, You need to provide an eval/search expression to the startswith and endwith  arguments . index=*bizx_application AND sourcetype=perf_log_bizx AND PID="PM_REVIEW" AND PLV=EVENT AND ACT="AUTOSAVEFORM_*" AND C_ACTV="*commentEdit*" OR ACT="*SendRequest" | sort - _time, CMID, SID, UID | transaction CMID SID UID startswith="ACT=AUTOSAVEFORM_trigReq_AutoSaveForm" endswith="ACT=AUTOSAVEFORM_after_sendRequest" | table _time duration eventcount   More details on here: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction#Filter_string_options    If this reply helps you, a like would be appreciated. ... View more

Hi @PNG, Your query will not work if one of the columns contains blank values in csv file. Try this: index="cisco_ios_config" sourcetype="ApplianceConfigurations:Cisco:IOS" | dedup host | fields - tag, -_raw, - tag::eventtype | rex field=source "\/usr\/local\/rancid\/var\/(?<host_environment>\w+)\/configs\/" | rex field=source "\/usr\/local\/rancid\/var\/\w+\/configs\/\w+-\w+-(?<extra_host_environment_check>\w+)-" | append [ | inputlookup ITSP:Compliance_Settings] | stats latest(_time) as _time, max(*) as * by host_environment,title,setting,must,value | foreach * [ eval field=if("<<FIELD>>"==setting,<<MATCHSTR>>,field)] | fillnull value="Setting not found" field | mvexpand field | eval fail=if(trim(field)==trim(value),if(must=="equal",0,1),if(must=="equal",1,0)) | stats sum(fail) AS "Count" by title | rename title AS "Setting" | eval Status=if(Count > 0, "error", "ok")   If this reply helps you, a like would be appreciated. ... View more

Ho are you  onboarding the data? Using universal forwarder or file upload? ... View more

Hi @tsabu, You need to upgrade indexer servers to 8.x. Check this link https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/Distsearchsystemrequirements#Compatibility_between_search_heads_and_search_peers  It clearly mentions A 8.2 search head is not compatible with a 7.3 search peer. If this reply helps you, a like would be appreciated. ... View more