I found a diffeernt way of doing this here https://answers.splunk.com/answers/369391/how-do-i-use-my-regular-expression-to-extract-valu.html ... View more

Hello sunnyparmer, i just changed order of the queries and changed stats to eventstats in the query ........I actually worked on my data with a similar query it is working fine..this is just due to the fact stats cannot pass data to another stats command in chain you have to use eventstats for that....i am sending screenshot of my query and data.... (host="e2e-onp-front" response="Message acknowledged successfully*") OR (host= "e2e-onp-bl-db" DocumentNotificationHookServiceImpl Successfully created notification ) org=|rex "Successfully (?created) notification"|eventstats count by notifications*|stats count(eval(like(response,"%created%"))) AS Total, count(eval(NOT like(response,"%created%"))) as Acknowledge| eval Diff = Total - Acknowledged... Let me know if it works ... View more

I don't think this is the same setting. Sunil's running into a limit at 50,000, and the default for dispatch.max_count is already higher at 500,000. ... View more

Regards Rakesh Vedicsoft Technologies ... View more

hi adamblock2, I can give the answer to your question...........let me explain you by taking my example.....Below u can see i have one categorytag...given to categoryId= Accessories .....also see the number of events and tags in the below diagrams and next same tag is given to another categoryId=Strategy when you take a tag for both events with a name it will take both events or none at all .......solution to ur problem naming two tags one with source_ip and destination_ip...... index=* tag= categorytag AND categoryID!=STRATEGY--------no results u r doing a(intersection) !a==definetely null i have created another tag as actiontag where action =purchase ( like destination_ip) i write query like this index=* tag=categorytag NOT tag=actiontag then u will get all the results for categories in category tag that doesnt have purchases...(ie..source ip).........let me know if it works ... View more

i got the answer from somebody else which is related to your question. It may use full for you check it once. https://answers.splunk.com/answers/352888/how-to-configure-the-splunk-universal-forwarder-an.html ... View more

Do you see the results for the query before the join?? ... View more

While installing SPLUNKLIB python module on a remote server where we dont have internet getting error as "Could not find a version that satisfies the requirement pycrypto (from splunklib==1.0.0)" I downloaded on the internet server using PIP DOWNLOAD SPLUNKLIB command & copied the files to remote server I able to install all below module except PYCRYPTO certifi-2020.4.5.1-py2.py3-none-any.whl chardet-3.0.4-py2.py3-none-any.whl idna-2.9-py2.py3-none-any.whl requests-2.23.0-py2.py3-none-any.whl urllib3-1.25.9-py2.py3-none-any.whl Please help. ... View more