Hello its so usefull. Thanks for the query . I have a question for this subject. I have a FieldA and this fileds like a FieldA="a\b\c\n\....\z" . its a long field. I want it to automatically split the field and give each value a name. so I actually want to see a manual version of field transforms. If you have an idea and would like to help, I would be glad. ... View more

Thanks @ITWhisperer ! It even works over a large dataset with multiple lines. A clear out-of box view, of taking the portion of event as a field and piping to rex  the relevant field.  Thanks again! ... View more

@nickhills I tried the transforms.conf, still its not showing up results for me. The input log is XML file and i have other custom conditions like LINE_BREAKER, BREAK_ONLY_BEFORE, MUST_BREAK_AFTER conditions in my props. I presume that is not making any impact on this transforms.conf settings. ... View more

Since these logs are from an .NET application, should I still use "Splunk HTTP Event collector"? In such case how the sourcetype should be configured? ... View more

@DalJeanis with increased data volume and with multiple fields, the initial part of the code "table _time Field1, Field2, Field3 makes the overall query to breach the search size limit, hence as an optimizing factor, by removing the part, still we get the same set of result. kindly let me know if this practice is allowed? ... View more

You need to remove the part of search where you're calculating the Total and move it after your eventstats max(... part. ... View more

Try using xpath or spath which are specifically for reading XML/JSON data in tree like structure. You can alternatively also use rex provided your XML schema is know to you so that you can define specific structure. Example XML node:Field XMLData = <NodeName>Sample Data</NodeName> 1) Using rex command -> rex field=XMLData ("&lt;NodeName&gt;(?<MyNodeName>\w+)&lt;/NodeName&gt;") Using spath command -> spath input=XMLData output=MyNodeName path=RequestType.NodeName The spath command will extract multiple key value pairs if they exist in the path provided. However, for rex command in order to get multiple key-value pairs you should set max_match property (any number representing number of matches and 0 implies all matches. Default is 1 for single match). https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath 2) If you are searching for element NodeName in your events, always make sure it is present in your base search filter i.e. index=YourIndexName sourcetype=YourSourceType AND "<NodeName&gt" AND "</NodeName&gt" 3) It would be preferable to include XML Header fields also in base search queries which remain same for similar events you are planning to search like "<RequestType&gtAddProductToCart</RequestType&gt". This way you are only looking at AddProductToCart XMLs and ignoring all others if they are not required in your search. 4) Finally, if there are too many XMLs being written quite frequently you should try to extract fields generate stats and push them to Summary index on aggregated fields as key value pair for faster searches. Refer si<stats> command where si is for summary index and <stats> could be stats, chart, timechart etc. Also collect command which is more user controlled through Scheduled Searches. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect ... View more

was the sourcetype is tomcat:runtime:log? or is it different? please let me know how you managed the sourcetype ... View more

Is there any performance related issues that may arise while using chart function over stats function? I mean which one takes a longer time to execute in a complex search query (with multiple appends, yet searched at index level). ... View more