Hi ITWhisperer thanks for the answer but i'm having problem in visualization as i want to split by  door i'm trying to use trellis but not working  as when i try to split by door using trellis i can't see the fruits in the graph   |makeresults |eval date="11/11/2022 04:36:07", door="112", fruit="APPLE", num="14" |append [|makeresults |eval date="11/11/2022 04:10:00", door="111", fruit="PEAR", num="8"] |append [|makeresults |eval date="11/11/2022 03:01:02", door="111", fruit="PEAR", num="119"] |append [|makeresults |eval date="11/11/2022 02:41:49", door="111", fruit="PEAR", num="82"] |append [|makeresults |eval date="10/11/2022 21:41:18", door="111", fruit="PEAR", num="26"] |append [|makeresults |eval date="10/11/2022 18:11:16", door="111", fruit="PEAR", num="12"] |append [|makeresults |eval date="10/11/2022 01:36:15", door="111", fruit="Orange", num="5"] | bin span=1h _time | stats sum(num) as count by _time door fruit       ... View more

HI @dasadmin  without the index name (the index should exist) it would either direct the events to main index or the default index in your settings it imp to define the index for any input source  thanks Note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated  ... View more

HI @dasadmin  it seems you have missed to define the index parameter in inputs.conf where the logs should be written  index = abc    Note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated  ... View more

Hi @KyleMcDougall  when you say 2 buckets can you please elaborate do you mean you want two panels in a dashboard ?? are can you share a sample output    note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated  ... View more

hi @KyleMcDougall  Have you tried the transaction command this command should group based on sessionID  and would give you an eventcount which gives you an idead about the number of intent related to each sessionID whether its  0 or 1 intent and 2 or more intent  |transaction sessionId  just an example  |makeresults |eval sesid="abc1234", data="amber", intent="payroll.help_preferences_standard" |append [|makeresults |eval sesid="abc1234", data="new", intent="payroll.update_account"] |transaction sesid |table sesid eventcount intent Thanks venky  note:- if it helps karma points are appreciated/if it resolves solution acceptance is appreciated  ... View more

HI @Mohanveera1  it could be that  the timestamp extraction for this sourcetype in the props.conf might be ignoring the time zone specifier probably you might want to consider using theTimezone(TZ) attribute if the event time stamp does not have  a time zone would you mind sharing the props configuration for this sourcetype   Note: if it helps karma points are appreciated/if it resolves acceptance of the solution is appreciated  ... View more

HI @sophiacyh  when  a field created at search time if you are saving that search in a dashboard or report or alert the field is not lost  even if you refresh and relogin .and to make it permanent you can use the Interactive Field Extractor and what do you mean by other environment can you share some thoughts on it   Note:If it helps karma points are appreciated/if it resolves solution acceptance is appreciated  ... View more

Hi @Kk  Better solution/suggestions can be provided if you paste some sample/dummy data  ... View more

Hi @Veeru  if it resolved your issue can you please accept the solution it might help others in the group   note:- If it helps karma is appreciated/if it resolves acceptance as solution is appreciated  ... View more

Hi @akashsawant  you can either redirect the output to kvstore or standard lookups  https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/kvstore/uselookupswithkvstore/ and then retrieve the results for your historic data usecase    if it helps karma is appreciated/if it resolves solution acceptance in appreciated ... View more

Hi @radparik  yes hostname is good enough just for clarity do you want to assign different sourcetype for different hosts or are you creating different indexes per server(which is not good idea) whats your use case here  Splunk can route events to a specific index based on the hostnames. below is a snapshot of  props.conf as well as the transforms.conf stanza where you can perform the index routing that you described. https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Transformsconf Props.conf  description = index where data is to be ingested TRANSFORMS-theindex=theindexbyhost Transforms.conf [theindexbyhost] SOURCE_KEY = MetaData:Host REGEX = regexto match  if it helps karma points are appreciated/if it resolves acceptance as solution is appreciated ... View more

hi @Veeru  you can try the below query  |makeresults |eval new = "2022-05-31 10:18:09 emea" |append [|makeresults |eval new= "2022-05-31 10:18:14 apac"] |append [|makeresults |eval new= "2022-05-31 10:18:20 us "] |eval new=replace(new,"emea", "CST emea") |eval new=replace(new,"apac", "HKT apac") |eval new=replace(new,"us", "EDT us")   If it helps karma is appreciated/if it resolves acceptance as solution is appreciated  ... View more

Hi @FrancoiseMathy  have you tried the below link https://docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/Applications/AppsWeb/Splunk.htm?TocPath=Administrator%7CIntegrate%20applications%7CAdd%20applications%20for%20SSO%7C_____209 ... View more

Hi @ramprakash  Yes it should be pretty straight forward you provide them the config details and they should be able to do it Thanks venky ... View more

Hi @ramprakash  if you want a line or event break before the date  [22/05/11@08:13:58.246+0200]  you could use either of the below setting  in props.conf  BREAK_ONLY_BEFORE_DATE = true OR  BREAK_ONLY_BEFORE=<regex> inyour case should be something like this  BREAK_ONLY_BEFORE=\[[\d+\/]+@[\d+:]+.\d+\+\d+\] ... View more