I was looking for this answer! This worked for me,  I have a Mac. ... View more

Combine the corresponding values with mvzip, then mvexpand, and extract the fields.   | eval combined_data=mvzip(mvzip(vivol,usage,"|"),limit,"|") | mvexpand combined_data | rex field=combined_data "^(?<vivol>[^|]*)\|(?<usage>[^|]*)\|(?<limit>[^|]*)"   ... View more

From 8.1 + : You can now use a more intuitive and better readable Syntax like index=main mysearchterm ```This is a comment``` | stats count by host   ... View more

You'll get better support for this question at the App author's Slack #community channel : https://www.baboonbones.com/#support ... View more

[company_product] TRUNCATE=0 TIME_PREFIX=\"-health_checkin_date\":\" TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%3N TZ=UTC CHARSET=AUTO KV_MODE=JSON INDEXED_EXTRACTIONS=JSON ended up solving it right after I posted this. I think it might be extra important to view the raw log and build the time prefix based on this, rather than attempt to guess based on the way Splunk shows JSON data all prettified. ... View more

I need to upgrade to 6.5 and take a look at this. Thanks for pushing me to look at this. I agree, stdev probably isn't the right 'algorithm' to use long term. ... View more

Did you get solution for it? I had stuck at same place. ... View more

Your transforms.conf worked amazing for me. All I had to do was format my source events like yours. Thank you! ... View more