@lguinn ♦ Sorry for posting my comments as Answer, reason posting here is I am unable to upload attachments in comments. my search is: index=splunktesting source="c:\testlog2\appledata.log" location=* bsystem=* product=*|chart count(product) by bsystem product output is as shown in image "splunkoutput" https://answers.splunk.com/storage/attachments/160253-splunkoutput.jpg I am looking for out put something like https://answers.splunk.com/storage/attachments/160254-expecting.jpg ... View more

unlimited users can be created ... View more

An eventtype is a search that runs when you specify eventtype=MyEventType; you can think of it like a "pipeless, parameterless macro" or even like a saved search. A tag is a not-necessarily-unique "nametag" given to a specific, definitive (wildcardless) Key-value-pairing. It is very much like an eventtype but it has the following differences: An instance of an eventtype name is defined by a single directive inside a single eventtypes.conf file but an instance of a tag name can be defined in an infinite number of separate tags.conf files. An eventtype definition can use wildcards and have any number of pre-pipe specifications (conjunctions) but a tag definition always contains a single key=value pairing. ... View more