Try something like this. your base search | search [| inputlookup yourlookup.csv | eval SIPURI='user-part'."*" | table SIPURI]  This is assuming that your lookup table has the field  "user-part" which contains partial value which your base search has for field "SIPURI". It would be beneficial if you can share you obfuscated search to get better answer. ... View more

You can try the `showSplitSeries` option in the the dashboard studio to show each line/series as it's own chart. See this runanywhere sample dashboard:  { "title": "Test_Dynamic_Charting", "description": "", "inputs": { "input_global_trp": { "options": { "defaultValue": "-24h@h,now", "token": "global_time" }, "title": "Global Time Range", "type": "input.timerange" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_5sPrf0wX": { "dataSources": { "primary": "ds_jq4P4CeS" }, "options": { "showIndependentYRanges": true, "showSplitSeries": true, "yAxisMajorTickSize": 4 }, "type": "splunk.line" } }, "dataSources": { "ds_jq4P4CeS": { "name": "Search_1", "options": { "query": "index=_internal \n| eval sourcetype=sourcetype.\"##\".log_level\n| timechart count by sourcetype" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_global_trp" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_5sPrf0wX", "position": { "h": 960, "w": 1240, "x": 0, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "options": {}, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } } ... View more

The coldPath, thawedPath  etc are folders inside the index folder in Splunk and they can be hosted on the same volume (the default installation of Splunk creates these folders inside $SPLUNK_DB folder, so it does the same). For the purpose of better performance (and sometimes cost efficiency), we recommend have separate volume for hot/warm and cold bucket (keep faster disk for host/warm and slower/cheaper disk for cold buckets are they are searched less often). ... View more

Give this a try index=_internal source=*var/log/splunk/search_messages.log ... View more

For your requirement, left join may not be ideal. Try this alternate implementation (replace make results query with your lookup/data query): | makeresults | eval DatabaseName=split("A B C"," ") | mvexpand DatabaseName | table DatabaseName | eval from="Lookup" | append [| makeresults | eval DatabaseName=split("A A1 10#A A2 20#C C1 40#C C2 50#D D 60","#") | mvexpand DatabaseName | table DatabaseName | rex field=DatabaseName "^(?<DatabaseName>\S+)\s+(?<Instance>\S+)\s+(?<CPUUtilization>\S+)$" | eval from="search"] | eventstats values(from) as from by DatabaseName | where isnotnull(mvfilter(match(from,"Lookup"))) | foreach CPUUtilization Instance [| eval "<<FIELD>>"=coalesce('<<FIELD>>',if(mvcount(from)=1 AND from="Lookup","NULL",null()))] | stats count by DatabaseName CPUUtilization Instance | table DatabaseName CPUUtilization Instance ... View more

Try adding following at the end of your search If your current search result contains _time and one field say "count" | eventstats sum(count) as TotalCount   If your search result contains _time and several dynamic column names, | addtotals fieldname="Totalcount" ... View more

Did you deploy any props.conf for this sourcetype on your search head? Since you're doing index time field extraction (with INDEXED_EXTRACTIONS = json), there is no need to search time field extraction. I've seen props.conf with search time field extraction (KV_MODE = json) along with index time field extraction causing double extraction. You need to use one. If you just want index time field extraction, explicitly set KV_MODE = none on search head. ... View more

I missed a colon in the regex. Added just now. Try the updated version. ... View more

Try like this (UPDATED)   | rex "http(s)*:\/\/([^\/]+\/)+customer\/(?<customerId>[^\/]+)\/product\/(?<productId>[^\/]+)"   ... View more

The equal sign might be causing issues, escape them with backward slash. Also, the OR keyword between two stats fields is invalid, remove it. index=abcd | stats count(eval(searchmatch("https://drive.google.com/uc?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"))) as "https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X" count(eval(searchmatch("value2"))) as "value2" ... View more

You'll want to backup your index data as well. https://docs.splunk.com/Documentation/Splunk/9.1.1/Indexer/Backupindexeddata ... View more

Give this a try Your base search to get all workstation names e.g. | tstats count WHERE index=windows by host | searc NOT ([| inputlookup code_countries.csv | table alpha-2 | eval host='aplha-2'."*" | table host]) | where match(host,"^\w{3}\d+") ... View more

How do they appear in Splunk right now? ... View more

Make sure you've SSL configured correctly on appropriate Splunk server. Use this link as reference: https://docs.splunk.com/Documentation/Splunk/9.1.1/Security/ConfigureSplunkforwardingtousesignedcertificates ... View more

Change the timerange of both panel to some historical time for which your summary index will have data. E.g. earliest=-24h latest=-2m@m. This way your summary will have some data summarized and your drilldown search will only look at raw data for summarized data time-range only. ... View more

Give this a try Find count of events by userAgent Your base search | rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)" | stats count by userAgent    Trend of distinct count of userAgents over time Your base search | rex "\]\s+(\"+[^\"]+){3}\"+\s+\"+(?<userAgent>[^\"]+)" | timechart dc(userAgent) as distinct_userAgents ... View more

Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation my base search | eventstats latest(Date) as latestDate | eval shouldInclude=if(Date=latestDate,1,0) | transaction ID | stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID | where shouldInclude=1   ... View more

Give this a try (run it without delete command first to validate result) index=threatintel | eventstats latest(last_updated_date) as latest_update_date by indicator | where NOT last_updated_date=latest_update_date | delete   ... View more

Give this a try base search |transaction ID | table date field1 field2 ID | eventstats latest(date) as latestDate | where date=latestDate | fields - latestDate ... View more

This link should help: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/DashStudio/searchTokens ... View more