Hi dtaylor, You have seen this https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477 since you are already thinking of using `stats`    The important thing is really to get a common field from the various data sets and use that in your stats in your case you could use the field `src_mac` as simple as  | stats values(*) AS * by _time src_mac after your base search should work as long as you get src_mac for all data sets.   Hope this helps ... cheers, MuS   ... View more

Hi there, Take a look at this https://community.splunk.com/t5/Splunk-Search/How-to-compare-fields-over-multiple-sourcetypes-without-join/m-p/113477  Basically, what you need to do is use an eval to normalise the client IP: | eval clientIp = coalesce(vpn.client_ip,matches event.src_ip) and use a 'stats ... by clientIp' Hope this helps ... cheers, MuS ... View more

Please add this  | eval foo=0 | foreach max* [ eval foo='<<FIELD>>'] | fields - max* | rename foo AS max at the end of your SPL 🙂  ... View more

Hi @Fabian_W , This app is indeed external hosted on GitHub, if you want to use it just clone the repo or download a copy of it. Hope this helps ... Cheers, MuS ... View more

Hi toocies, Take a look here https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/ this has some good examples for your use case.   Hope this helps ... cheers, MuS ... View more

Hi there, The tstats command performs queries on indexed fields in tsidx files. The indexed fields can be from indexed data, metadata or accelerated data models. This means it will not scan the _raw events and should normally be super fast except you have bloated tsidx files due to the above mentioned cases. So usually the answer using `tstats` would be the best options and like you said `metadata` does not provide an index name ... but I tried something like this    | dbinspect index=* | rename index AS baz | table baz | map maxsearches=100 search="| metadata type=sourcetypes index=$baz$ | eval foo=$baz$"   which almost worked but something once the search is done removes the field `foo` from the result 😞  Not too good in web/UI debugging but I suspect its related of some UI cleanup of `_fieldname`  cheers, MuS ... View more