This worked for me 🙂 index=notable search_name="*your notable title*" | delete ... View more

Hi, Few corrections i think: 1. No comma used in eval statements for creating multiple eval fields. Reference-> https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/SearchReference/Eval 2. Stats usage is | stats min(_time) as end max(_time as start by action src url. if you want to add count also,then use | stats count as "new_label" Reference-> https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Stats index=proxy src=$ip$ [|gentimes start=-1 | addinfo | eval earliest=$global_pckr.earliest$| eval latest=relative_time($global_pckr.earliest$, "+7d"] | stats count min(_time) as end max(_time as start by action src url ... View more

Can you please elaborate more. Like where is the app/add-on pushed, reference link to the add-on, sample data ingested etc.. This will help in troubleshooting better. Also please note that even though the the udp reception is at a heavy forwarder, it is recommended to push the add-on/app in heavy forwarder as well as search heads cheers - ... View more

It auto-extracted for me and i just had to type "| table id, roll_number, new_map.8890.number, old_map.8890.number" May be you can clarify more on what should be the expected result ... View more

You have almost developed a FIM solution. it was a nice thread to read ... View more

Though I didn't understand your question completely, what i think is your regex seems to be good. You can achieve what you are looking for with a little different approach. Try using this search for your dashboard/report/alert etc, "stats first(AgentInitialResponseTime) by Agent" Alternatively try "stats last(AgentInitialResponseTime) by Agent" to see if you need the opposite results. ... View more