splunk receives 2 different stream data sets on a single hec (json). set 1 has call records set 2 has call status/disposition so if i want call detail information from set 1 on calls that meet criteria in set 2, i have to join the records. i used to use 'join' but read several articles about other ways and came across this method which I like, but really feels so slow/heavy     index="myindex" resource="somefilter" | stats values(*) as * by guid | search column="terminated"     because we have millions of rows to search from and i'm just looking for a few. I tried adding my search criteria higher up, like this:     index="myindex" resource="somefilter" column="terminated" | stats values(*) as * by guid     but then the other columns come back empty (I presume because it filtered them out, so nothing to join). So looking for another/faster/better way to: 1. get data from set 2 with criteria X 2. bring back matches of that data from set 1. Always many thanks for the education! ... View more

Greetings. We recently turned on a HEC and have JSON data coming in and I have noticed that multiple JSON blobs are embedded in _raw.  I searched several solutions and found one that actually did parse _raw into a new colum "split_raw" and then I went so far as to try     | eval raw=split_raw     but when I do     | table *     it still shows all the data from the first entry only I think my questions are: 1. the ones that are 'multiple json entries' I think is when 'a bunch arrive at about the same time' - so is there a way to FORCE these to split at ingestion (to guarantee 1:1 json-to-event)? my guess is i may need to play with my source_type, but looking for some guidance/thoughts. 2. if not, will have to split them (like the link above) and then do some processing on the new split_raw field? Thank you so much for leads and thoughts on this! ... View more

I have two streams of data coming into a HEC.  one has call direction (i.e. inbound) and the other has call disposition (i.e. allowed).  at first i was joining these streams (join), but found a great thread in the community suggesting using stats and so with some cleanup, i have something like this:   index="my_hec_data" resource="somedata*" | stats values(*) as * by id   which works great, and may not even be related to my actual question, but next I want to count by day, cool, so just timechart it, but i suppose my real question is Is that the most efficient way to count calls by day?  or should i do some higher level aggregation somehow? i don't even know if that makes sense, but if there are 2M calls a day and I go back 30d, is "counting 60M rows" the best way to display 'events per day?' ... View more