Hi @DalJeanis i am using a similar search to extract field from the "source" field. my query is index=xyz sourcetype="abc" host="hostname" |rex field=source ".?\bxyz\b\/(?.?)\/" But when i add the same extraction in the field extractions from the settings tab i add the expression as field=source ".?\bxyz\b\/(?.?)\/" when i do this the extraction doesnt work ... View more

This one row represents one timeline for a process. In reality, the row has many more date and times but only listed a sample here for simplicity sake. ... View more

Thanks this worked! ... View more

Please assume that you must join the tables. Just trying to provide a simple example. Thanks! ... View more

Thank you! I had accidentally left out the "type=left" in my example. Not including "max" was my issue. I agree that "join" is a last resort. How would you do this sample search with something more effective (since join is max 50,000). Thanks! ... View more

Your sample size is too small to get a semi-accurate result for the New Model Data.. Try expanding your sample size ... View more

To retain the old values, we need to use a different field name in streamstats (and where clause). Like this your current search giving fields Date and Val | sort 0 Date | streamstats current=f window=1 values(Val) as OldVal | eval Change=if(isnull(OldVal) OR OldVal=Val,"no","yes") | sort 0 -Date | fillnull value="Not Applicable" OldVal ... View more

Hi ryanprayacn, There are no hard limits, but there are configureable resource limits defined in the following conf file: Splunk_ML_Toolkit/default/mlspl.conf Because MLTK fits models on the search head, we give customers the ability to control these limits via the file above, with reasonable defaults. As an aside, you should consider whether you really want to fit on that many events. Linear regression, for example, is unlikely to yield significantly different results on 7M events compared with, say, 500k random events. Depends on your data and application, of course. 🙂 Does this answer your question? Cheers, - Adam ... View more