Permissions are good and the file listed from the command points to the new certificates ... View more

Here is the log - Basically it's only cert errors from the bottom until this date. We started receiving those once we switched to a third-party cert. 2015-10-12T13:05:02.793Z [conn1315] dropDatabase s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ finished 2015-10-12T13:05:02.793Z [conn1315] allocating new ns file D:\Program Files\Splunk\var\lib\splunk/kvstore\mongo\s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.ns, filling with zeroes... 2015-10-12T13:05:02.824Z [FileAllocator] allocating new datafile D:\Program Files\Splunk\var\lib\splunk/kvstore\mongo\s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.0, filling with zeroes... 2015-10-12T13:05:02.855Z [FileAllocator] done allocating datafile D:\Program Files\Splunk\var\lib\splunk/kvstore\mongo\s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.0, size: 16MB, took 0.036 secs 2015-10-12T13:05:02.855Z [conn1315] build index on: s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.c properties: { v: 1, key: { _id: 1 }, name: "_id_", ns: "s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.c" } 2015-10-12T13:05:02.855Z [conn1315] added index to empty collection 2015-10-12T13:05:02.855Z [conn1315] build index on: s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.c properties: { v: 1, unique: true, key: { _user: 1, _key: 1 }, name: "_UserAndKeyUniqueIndex", ns: "s_splunkiTR2RCAYp7Go4kZlq1TnMAm9_tHostIOJejUoOGxdcrt2VUpbxhK3iJ.c", background: true } 2015-10-12T13:05:02.855Z [conn1315] added index to empty collection 2015-10-12T13:05:02.902Z [conn1315] end connection 127.0.0.1:51492 (4 connections now open) 2015-10-12T13:09:34.947Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter 2015-10-12T13:09:34.947Z I CONTROL Hotfix KB2731284 or later update is not installed, will zero-out data files 2015-10-12T13:09:35.212Z I CONTROL dbexit: The provided SSL certificate is expired or not yet valid. rc: 2 2015-10-12T13:16:09.070Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter 2015-10-12T13:16:09.086Z I CONTROL Hotfix KB2731284 or later update is not installed, will zero-out data files 2015-10-12T13:16:09.491Z I CONTROL dbexit: The provided SSL certificate is expired or not yet valid. rc: 2 2015-10-12T13:39:40.881Z W CONTROL No SSL certificate validation can be performed since no CA file has been provided; please specify an sslCAFile parameter 2015-10-12T13:39:40.897Z I CONTROL Hotfix KB2731284 or later update is not installed, will zero-out data files 2015-10-12T13:39:41.365Z I CONTROL dbexit: The provided SSL certificate is expired or not yet valid. rc: 2 ... View more

Thanks for the info. Unfortunately, that didn't seem to do the trick. It was set to local admins for the folder structure, which the user was part of. I changed ownership to be the user itself, restarted, and still receive the error. ... View more

UPDATE I found the missing events. For some reason, while I choose to use the current index time as the _time field, about 250 of the events are using varying time. I'm looking at a span of 24 hours or 1 week while these have a time of back in 2006-2007. Now I just have to figure out how to address this. ... View more

The numbered column represents users associated to the trusted drive. It looks like the missing events have varying data in those fields so it's not that. I may try and alter the query to only include information I need, which is only the name and drive serial. I'll see if that makes a difference. Thanks for your help. ... View more

I just checked into the rows and it looks pretty random. It begins at row 274 and then after that is missing 276, 278, 284, 300, 301 etc.. Here is the data in the surrounding rows, but I don't see anything unusual. 271 SBC20077 271 \.\PHYSICALDRIVE0 100616PCK330VKK6MSPJ Hitachi HTS725032A9A365 1412622639180 2 False 272 CMM01036 272 \.\PHYSICALDRIVE0 5VCGYK22 ST9250317AS 1317335321260 2 False 273 SBC20069 273 \.\PHYSICALDRIVE0 100616PCK330VKK68WNJ Hitachi HTS725032A9A365 1394157394820 2 False 274 SBC10013 274 \.\PHYSICALDRIVE0 100903PCK330GKGEH33K Hitachi HTS725032A9A365 1310679115177 3 False 275 SBC20197 275 \.\PHYSICALDRIVE0 100616PCK330VKK47EWJ Hitachi HTS725032A9A365 1431131118240 2 False 276 SBO20013 276 \.\PHYSICALDRIVE0 100903PCK330GKGE67AK Hitachi HTS725032A9A365 1447354139470 2 False 277 SBC20073 277 \.\PHYSICALDRIVE0 100616PCK330VKK60KRJ Hitachi HTS725032A9A365 1422490991457 3 False 278 CMMC20247 278 \.\PHYSICALDRIVE0 100903PCK330GKGE7T2J Hitachi HTS725032A9A365 1430866533340 2 False ... View more

I just find eventstats to be easier because it adds the _time field and doesn't convert to epoch times like it does when you add via stats. I actually figured it out, not sure if it's the best way, but I got it going. You were basically right when you say I had to many unnecessary fields. They were clouding up the numbers. The only thing I needed to group together in an mvfield was the indexes. The data would be accurate unless a particular item was either removed from an index or added to an index throughout the week. If this occurred then when looking over a 7day time range it would show that the item always had two indexes in the index field, even though for certain days that was not the case. Here is the search that ended up giving me correct numbers - sorting by time seemed to work better then date_mday which was another option, but it limits me index=index1 OR index=index2 | eval Name=coalesce(lower(Name),lower(Name2)) | bucket _time span=1d| eventstats values(index) as index BY Name,_time | where Status="Enabled" AND (Type="Type1" OR Type="Type2" OR Type="Type3") and index!="bh_lh_encryption" | timechart span=1d dc(Name) ... View more

Here are the numbers I get for when I perform the search over the past week with a 1d span Count _time 51 2015-11-04 51 2015-11-05 204 2015-11-06 51 2015-11-07 51 2015-11-08 51 2015-11-09 53 2015-11-10 When I run the search on each individual day I get this Count _time 66 2015-11-04 60 2015-11-05 224 2015-11-06 56 2015-11-07 56 2015-11-08 58 2015-11-09 63 2015-11-10 I can't really break up the search because I'm using this method to combine a field of names and the data is reliant on fields from both searches. ... View more

That does it. Thanks again! ... View more

This along with the previous answer both seem to get the job done, with the previous answer including all of the fields that I can use for additional manipulation. Thanks for the help!! ... View more

Thanks! That seemed to do the trick. ... View more

Thank you! Works great. I also found that the join command worked for me as well, but I prefer your way. Search | stats dc(eval(DISPLAYNAME)) AS Total| join [search "index" (STATUS=Offline) | stats dc(eval(DISPLAYNAME)) AS Offline] | eval Percentage=round((100*(Total-Offline)/Total))."%" | fields - Total, Offline ... View more