so, it turns out I was making two mistakes, I had to put the field name in single quotes and the value in double quotes which seemed to do the trick. index = myindex | rename clientRequest.uri as uri | eval uri=if('edgeRequest.httpMethod'=="POST", "value1", "value2") | stats count by uri ... View more

So, unfortunately I managed to find the answer. Splunk currently does not support nanoseconds, and the largest timestamp they can handle is microseconds ! So if you see yourself in the same situation, you will need to apply the below config to the search, (assuming your json strings timestamp field is called timestamp), [cloudflare] INDEXED_EXTRACTIONS=json KV_MODE=none NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TIMESTAMP_FIELDS=timestamp TIME_PREFIX=^timestamp:" MAX_TIMESTAMP_LOOKAHEAD = 10 ... View more

Hi rusty009, this seems like an issue with the bundle size, or otherwise some issue with the search head transmitting the bundle to the indexer. This is a tarball of config files, which tends to grow over time, and usually gets tipped over the edge by large lookup files. My recommendation is to look at the internal log for the indexers and search on index=_internal method=POST status!=200 source="*splunkd_access.log" If you find events indicating issues, you can configure replicationBlacklist in server.conf to stop certain files or directories from being included in the bundle, or otherwise remove unneeded files entirely. ... View more

I would drop the latest, and move the earliest field to the first column and rename it to datetime... etc. Then in props.conf I'd use TIMESTAMP_FIELDS = datetime http://docs.splunk.com/Documentation/Splunk/6.2.6/Admin/Propsconf Then I'd index the csv instead of using it as a lookup. Then you can do things like searching for a specific time frame... and you'll only see events from that time frame with the Ips from that time frame. You can then do things like | stats min(datetime) by IP .... | timechart max(datetime) by IP .... ... View more