This search works, but it's slow. I know nested searches are no longer recommended. Can anyone help me re-write this search for better performance? xd_index sourcetype="xendesktop:7:icasession" UserName="" host="" | eval UserName = lower(UserName) | join UserName HostedMachineName [search xd_index sourcetype="xendesktop:7:session" UserName="" host="" ClientAddress=* | eval UserName = lower(UserName)] | stats sparkline(avg(LatencySessionAverage), 1m) as "Latency Trend" by UserName LatencyLastRecorded AgentVersion ClientAddress ClientVersion IPAddress ClientPlatform HostedMachineName BrokeringTime | lookup COSTCENT RACF_ID AS UserName OUTPUT RACF_Name | fields UserName RACF_Name LatencyLastRecorded "Latency Trend" ClientPlatform ClientVersion ClientAddress IPAddress HostedMachineName BrokeringTime | sort -LatencyLastRecorded | dedup HostedMachineName ... View more

I have a CSV file with about 200 fields in it. The first line is useless, and the second line contains the field names. However, the field names are not delimited with a quote and a comma, but only a comma. The fields are delimited with both quotes and commas. I've tried the inputs, props, and transforms.conf as below. I also have some sample data below inputs.conf [monitor:///$SPLUNK_HOME/etc/apps/search/lookups/ControlUp_Computers_05_14_2016_15_00_20.csv] sourcetype=ControlUPComputer index = main disabled = false interval = 60 Props.conf [ControlupComputer] DATETIME_CONFIG = CURRENT INDEXED_EXTRACTIONS = csv KV_MODE = none NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false pulldown_type = 1 HEADER_FIELD_DELIMITER = , HEADER_FIELD_LINE_NUMBER = 2 FIELD_QUOTE = " FIELD_DELIMITER = "," TRANSFORMS-ControlupComputer = ControlupComputerTransform transforms.conf [ControlupComputerTransform] DELIMS = , FIELDS = Stress Level,Name,Status,Operating System,System Type,CPU Count,Memory,Uptime,User Sample data from CSV file - Notice the text "Table:Computers"? That is what I need to ignore Table: Computers Stress Level,Name,Status,Operating System,System Type,CPU Count,Memory,Uptime,User Sessions,CPU,Memory Utilization,Disk Queue,Free Space on System Drive,XenApp Server Load,Avg. Disk Read Time,Avg. Disk Write Time,Net Total,Sessions,XenApp Server Logon Mode,Net Sent,Net Received,Domain DNS,Domain Role,OS Service Pack,Organization,Processes,Install Date,Last Boot,Manufacturer,Model,View Agent Version,Windows Directory,Pages / sec,Disk Reads / sec,Non-paged Pool Memory,Disk Writes / sec,Disk Transfers / sec,Error Rate,Warning Rate,IP Addresses,DNS A Records,Physical Addresses,Registered IP Addresses,Active Sessions,Idle Sessions,Disconnected Sessions,Other Sessions,Max Free Space Drive,Min Free Space Drive,Top Citrix License Utilization,Folder,Description,Processor Queue Length,Paging File,Physical Disk Time,XenApp Resolution Time (ms),XenApp DataStore Connection Failure,XenApp Number of busy XML threads,XenApp Resolution WorkItem Queue Ready Count,WorkItem Queue Ready count,XenApp License Server Connection Failure,XenApp License Check-Out Time (ms),XenDesktop Database Avg. Trasaction Time,XenDesktop Database Connected,XenDesktop Database Transaction Errors / sec,ASP Request Queued,ASP Request Rejected,CSG Connections,XenApp Load Evaluator,XenApp Worker Group,XenApp Farm,XenApp Zone,XenApp Zone Data Collector,XenApp #Published Applications,XenApp Version,XenApp Edition,XenDesktop Desktop Group,XenDesktop Farm Name,XenDesktop Desktop Kind,XenDesktop Desktop State,VDA Version,XenDesktop Catalog Name,XenDesktop MCS Image Out of Date,PVS vDisk File Name,Computer Local Time,Logon Server,Avg. Logon Duration,Guest Name,Host Name,VM Name,VM Power State,VM Tools State,VM Tools Version,VM Tools Version State,Active memory,Host CPU Usage,Physical memory used,Dropped Received Packets,Dropped Transmitted Packets,CPU Ready,CPU Excessive SMP use,CPU System time,CPU Swap Wait,Memory SwapIn Rate,Memory SwapOut Rate,Virtual Disk Read IOPS,Virtual Disk Write IOPS,Virtual Disk Reads KBps,Virtual Disk Writes KBps,Virtual Disk Read Latency,Virtual Disk Write Latency,Hypervisor Platform "2.00","","Ready","Windows Server 2008 R2 Enterprise ","x64","4","20 (GB)","10:15 hours","0","0.4025722","22","0.001513883","28,918,460,000.00 (C:)","1206","0.00","0.01","0.1881534","2","AllowLogons","0.1138949","0.07425845",".com","MemberServer","Service Pack 1","of FL","88","10/8/2012 9:14:34 PM","5/14/2016 4:45:03 AM","VMware, Inc.","VMware Virtual Platform","N/A","C:\Windows","0","0","2.301047E+09","0","0","0","0","10.8.202.98","10.8..98","00-50-56-8B-4E-F1","1","0","0","0","0","28,918,460,000.00 (C:)","20,163,130,000.00 (F:)","0.00","blue\servers\2008\terminal servers\vendor","","0","0","0.02158756","0","0","0","0","0","0","0","0","0.00","0","0","0","0","Standard Load Eval","All_Servers Vendor ... View more