This worked for me on version 8.x recently. Thanks. ... View more

Thanks D... No go unfortunately. | tstats summariesonly count FROM datamodel=Web.Web BY Web.url, Web.client_ip where Web.url IN ("0aqpqdju.me", "0x1f4b0.com",...) Error: Error in 'TsidxStats': Wildcards (*) are not supported in groupby fields (FYI - The wildcards are being stripped in the above query when posted here.) As to the second option it won't work. It has to contain the wildcards since the url can vary wildly. Seems like this should be a simple pattern matching search against the DM. Someone suggested using macros.conf and transforms.conf in another channel. Will give that a try. ... View more

Stand corrected. I had to close and clear out my cache on Chrome and it displayed correctly. Seems to be working as intended and I see no side effects of hiding the code in the .css. Thank you Sir!! ... View more

As per https://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/ProtocolDetection yes ... View more

Hello, I'm one of the App/Add-on developers. It does expect CEF format, sorry if there is any confusion about that. I'll update the documentation to better reflect this requirement. Thanks for your feedback and for following up on your question. ... View more