My query works from Splunk Web UI and returns field values of Source in a table form, but it doesn't work from the CLI. Splunk web returns Source ========== stock funds Splunk CLI returns output EMPTY Source =========== Splunk CLI doesn't returns the field values with the table command. splunk search "index=apps sourcetype=weblogs | rex field=_raw \'Source:\s(?<Source>.*)\' | search Source | dedup Source | table Source" user admin password changeme I have tried with eval and fields command instead of table splunk search "index=apps sourcetype=weblogs | rex field=_raw \'Source:\s(?<Source>.*)\' | search Source | dedup Source | eval chicken=Source | fields chicken" user admin password changeme but still it output empty values chicken =========== But it works well in web search results Is there any other way to display the field values from command interface ? ... View more

Is there any way to save the count of the events before doing the dedup ? This is my query index="webapplication_logs" sourcetype="error_log" | rex field=_raw "Severity:\s (?<Severity>.+)" | search Severity = Error This query lists all my Severity=Error events (i.e, total:3 events in the last 10minutes custom timeframe) .................... Date: [07/Mar/2004:16:04:49 -0800] IP: ipaddress Method: "GET /topicparent=Main.ConfigurationVariables HTTP/1.1" Response: 401 Type: Info Severity: Error .................... .................... Date: [07/Mar/2004:16:05:49 -0800] IP: ipaddress Method: "GET /topicparent=Main.ConfigurationVariables HTTP/1.1" Response: 401 Type: Info Severity: Error .................... .................... Date: [07/Mar/2004:16:07:49 -0800] IP: ipaddress Method: "GET /topicparent=Main.ConfigurationVariables HTTP/1.1" Response: 401 Type: Info Severity: Error .................... Now I used Dedup to show only one result in the last 10minutes timeframe. index="webapplication_logs" sourcetype="error_log" | rex field=_raw "Severity:\s (?<Severity>.+)" | search Severity = Error | dedup Severity OUTPUT .................... Date: [07/Mar/2004:16:07:49 -0800] IP: ipaddress Method: "GET /topicparent=Main.ConfigurationVariables HTTP/1.1" Response: 401 Type: Info Severity: Error .................... But I want to show the total error events count (i.e 3 events) in the output or either count saved in the field. I have tried the eval command to save the count, but field value count shows 1 after using dedup (skipped this method). | eval tcount = mvcount(Severity) Then I have used stats command which counts the events but doesn't show the raw event. | stats count by Severity I have included the _raw with the stats command but COUNT didn't work may because the _raw event timestamp is different. | stats count by Severity, _raw OUTPUT Severity Count _raw Error 1 event Error 1 event Error 1 event But how to show the count of the events as well as the 1 similar error event ?. DESIRED OUTPUT Severity Count _raw Error 3 event OR any other methods to save the events count before dedup ? ... View more

I have an index called high with sourcetype logs logs sourcetype is continuously indexing logs under \logs dir. I have decided to create a new index and want to move those logs to that new index called Medium . I have successfully moved the events to Medium, index="high" sourcetype=logs | collect index="Medium" but I can't see the events with the sourcetype index="Medium" sourcetype=logs no events found index="Medium" It works and shows all the events, but not real-time logs. And when new logs were updated under logs sourcetype, Splunk is showing those real-time logs under index high , not under the Medium index. How to show real-time events under medium index instead of high index with sourcetype logs ? ... View more