@aiguofer can you share the complete script and all the required libraries to successfully execute this script. Any help is greatly appreciated.  ... View more

@lbrhyne I've come across the same issue. Can you actually share the SPL for the bug and also can you share how the apps are listed in the dropdown? ... View more

@lbrhyne Can you share the SPL for the know issue?  ... View more

As, I remember reading thru the docs after 7.3 licensing for metrics is capped at 100 bytes per event which in turn seems to be a game changer. But we don't have a short ETA to get to 7.3 or later versions which makes me think about conversion of standard event format to multikv. ... View more

Great work! Hoping that my comments would be helpful if someone whats to reduce the Licensing cost on perfmon data: I have experimented on migrating the Perfmon logs to metrics/multikv from a standard event format. Where both of the new formats has shown better results over the generic event formats in diff areas i.e., Licensing cost/storage reduction/ Search Performance. Metrics: Better performing during the search time and cost wise it's more expensive than a regular event format because of the standard measuring of each metric log as 150 bytes when indexed. Metrics format in return resulted in consuming higher Licensing when compared to Event data. MultiKv: mode=multikv is more efficient and granular when compared to regular event data with around 60% less license consumption when compared to other to formats with all the counter in a single logs to work efficiently. After playing with all the 3 formats i've decided to move forward with multikv but I'm having hard time understanding the historic data migration of generic data format to multikv? Did someone played around converting the historic perfmon event data into multikv? ... View more