Wanted to share some good news regarding this issue with the broader community - over the past year we worked with Splunk and Microsoft support and development teams to sort this out. In our organization, 99% of the corrupt events were when Windows was rebooting - a fix for this was identified and successfully tested in our environment. Remaining issue was related to an api error response from EventLog api and a fix for that is in the works per Splunk Dev and support. Both fixes are expected to make it into 9.1 (hopefully around .CONF23). And here's some recommendations that came from the collaborative work with Microsoft. Use 'Delayed Start' for the Splunk Forwarder service. Setup following service dependencies to reduce errors sc config EventLog depend=RpcSs sc config SplunkForwarder depend=EventLog ... View more

See if you can avoid join by getting LPN1 and LPN2 and coalescing them.  Then do a stats to get the values needed. source="C:\\Logs\\*" host="myHost" index="dumpchutes" ("TELEGRAMID=[42]" "LastDestination=[51]") OR ("TELEGRAMID=[CONTAINERSTATUS]" "ContainerState=[DIVERTED]" "Divert=[PALLETIZE]" "ReasonCode=[DS]") | rex "OriginalDestination=\[(?<OriginalDestination>[^\]]+)" | rex "OriginalDestinationState=\[(?<OriginalDestinationState>[^\]]+)" | rex "EntrancePoint=\[(?<EntrancePoint>[^\]]+)" | rex "EntranceState=\[(?<EntranceState>[^\]]+)" | rex "ExitPoint=\[(?<Chute>[^\]]+)" | rex "ExitState=\[(?<ExitState>[^\]]+)" | rex "BarcodeScannerId=\[(?<BarcodeScanner>[^\]]+)" | rex "BarcodeScannerDataState=\[(?<BarcodeScannerDataState>[^\]]+)" | rex "BarcodeScannerData=\[(?<LPN1>[^\]]+)" | rex "Length=\[(?<Length>[^\]]+)" | rex "Width=\[(?<Width>[^\]]+)" | rex "Height=\[(?<Height>[^\]]+)" | rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" | rex "PalletId=\[(?<ChuteHolder>[^\]]+)" | rex "LpnNumber=\[(?<LPN2>[^\]]+)" | rex "WcsLocation=\[(?<WcsLocation>[^\]]+)" | rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" | eval LPN=coalesce(LPN1,LPN2) | stats values(*) as * by LPN ... View more

I was looking for a solution to similar problem and came across your post. See example here to do the coloring - https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html. Then use fields option in simple xml to show only the columns you want. Have fun! ... View more

Here's a simple fix to the app if developer is watching this thread - in the api call add '+and+signinDateTime+le+(current time - delay minutes)'. So the new filter query will look like: &$filter=signinDateTime+gt+(check point time)+and+signinDateTime+le+(current time - delay minutes) With delay minutes set to 5, this will get 99% of the data considering MS's less than 5 minute latency for 99% of events. And if you're making the change, please let the user control the delay minutes. ... View more