@zacksoft_wf  Hi there, not sure if just one SPL can give all the stats you're after, but if you navigate to Configure --> Content Management -->  And on Search window type "Authentication", this gives a list of items configured under Authentication. Did you try this already OR you need still need a SPL to query a statistical view?  ... View more

@robertlynch2020  Hi there, I found couple of resources for the error message but not sure if they would help, but may lead to isolate the issue.  https://www.tek271.com/software/java/memoizer https://www.baeldung.com/guava-memoizer Since it's a single SH,  are you doing any API pulls / DB Connect sort of mechanism to pull the data in? Was there any recent app installation / upgrade happened?  I would disable above API/ DB Connect inputs one by one and isolate the issue.  Are these error messages from splunkd.log?  ... View more

Hi there, we had the same issue ever since we jumped into 7.2.3 from 7.0.3. For an example on Proxy TA props.conf we had aliases configured such as below. FIELDALIAS-http_referrer = cs_Referer as http_referrer FIELDALIAS-user_agent = cs_User_Agent as http_user_agent But on transforms.conf had the field alias instead of the actual field name - something like below. REGEX = (?\d{4}-\d{2}-\d{2})\s+(?[^\s]+) ... (?-|\S+)\ ... (?\S+) ... By changing the RegEx to actual field name was fixed this issue and Splunk support will update their release notes under SPL-166565 stating that the field extraction is more restrictive on 7.2.3. ... View more