If you have separate hot/cold storage paths, I assume you would need to run this test multiple times with a different "directory" setting for each? ... View more

Thanks - using list fixed up the issue. Appreciate the help! ... View more

Thanks - knowing that there weren't any options out there to do it directly in Splunk I ended up cobbling together a gawk script that was able to convert the output to a tilde-separated field. ... View more

In this particular case K actually does equate to thousands while M equates to millions - not necessary kilo and mega. 21.7K should value out to 21700 while 2.11M should value out to 2110000. We don't see any values higher than an M ever. I adjusted the M to multiply by 1000000 and that fixed the problem. Thanks for all your help with this and I'll definitely be able to apply to my others use cases! ... View more

Adding the true() statement definitely seems to fix the no suffix issue. However, I'm still seeing invalid results when the suffix if "M". I hate not being able to upload images from work - it would make this a lot easier. Using the eval statement provided above and an event of: Network Congestion 2.11M 29.2K 27.4K 27.4K 27.4K 27.5K 37.4K I get the following results: Congestion 21100 network_congestion 2.11M With the same eval statement and a data set of: Network Congestion 21.7K 8531 8699 8755 8602 9862 0 0 0 0 I get the following results: Congestion 21700 network_congestion 21.7K ... View more

I also noticed that while it works for values of "K", it does not appear to work for values of "M". We just had one come in that was congestion=2.05M and the dataInt field value ended up as 20500 which would mean it's being captured by the "K" case. ... View more

Thanks niketnilay - I ran with this and it looks like it's creating a new field called dataInt that has the new values in it. However, I noticed that any original values that didn't contain one of the alphanumeric identifiers are completely excluded (i.e. cases where congest=0 or any other value under 10K). Is there a way to add another statement to the case where if it doesn't match any of those you just multiply by 1? ... View more

Also of note, the values will not always have a "K" in them. We do see events that come in like this: Congestion 0 55.3K 1836 40.2K 39.9K 38.9K 40.9K Whatever solution is devised needs to be able to account for situations where the "K" is not present - I tried the convert memk() command but it didn't handle the entries that didn't have the "K" properly (didn't convert them to K base units). ... View more

We've already extracted the value out into a field that contains the alpha identifier (i.e. congestion=39.6K). The line included above is part of a much larger event - but it will always look like the above and will only ever have a single value (no mv fields for this one). ... View more

I checked the job inspector and I see that it definitely looks like it's hitting all of the servers - I see the remoteSearchLogs for all of the appropriate systems and invocation counts look accurate and expected. The resultCount in the inspector shows 235 (which is pretty accurate) - it just only shows results of 100 in the display. ... View more

I mentioned this in my other comment above but want it here attached to the accepted answer as well - we were only able to get this working after we moved the props.conf from the indexer cluster to the HF running HEC itself. When running on the indexer cluster it was as if the props.conf didn't even exist. ... View more

Thanks to Support I was able to get this working. We found a couple of different things: 1) The props.conf was really close - we had to make 1 change to get it working properly (missing an escape on +[)?) ). Here's the final props.conf that worked: [asset_play] CHARSET=UTF-8 SHOULD_LINEMERGE=false disabled=false SEDCMD-fixfooters=s/]}//g LINE_BREAKER=([\r\n,]*(?:{[^[{]+\[)?){"earlyAccess TRUNCATE=0 TIME_PREFIX="deviceTimestamp": MAX_TIMESTAMP_LOOKAHEAD=30 TIME_FORMAT=%s%3N KV_MODE=json 2) We also discovered that putting props.conf on the indexer cluster did not work. Anything that was brought in through HEC was essentially untouched by anything in props.conf on an indexer. We had to specify this props.conf on the HF on which HEC was running. Thanks everyone for your help with this! ... View more

I definitely agree - it sounds like it should be working. Here's what I'm seeing in the btool output: /opt/splunk/etc/apps/search/local/props.conf [asset_play] /opt/splunk/etc/system/default/props.conf ANNOTATE_PUNCT = True /opt/splunk/etc/system/default/props.conf AUTO_KV_JSON = true /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE = /opt/splunk/etc/system/default/props.conf BREAK_ONLY_BEFORE_DATE = True /opt/splunk/etc/system/local/props.conf CHARSET = UTF-8 /opt/splunk/etc/system/default/props.conf DATETIME_CONFIG = /etc/datetime.xml /opt/splunk/etc/system/default/props.conf HEADER_MODE = /opt/splunk/etc/system/local/props.conf KV_MODE = json /opt/splunk/etc/system/default/props.conf LEARN_MODEL = true /opt/splunk/etc/system/default/props.conf LEARN_SOURCETYPE = true /opt/splunk/etc/system/local/props.conf LINE_BREAKER = ([\r\n,]*(?:{[^[{]+[)?){"earlyAccess /opt/splunk/etc/system/default/props.conf LINE_BREAKER_LOOKBEHIND = 100 /opt/splunk/etc/system/default/props.conf MATCH_LIMIT = 100000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_AGO = 2000 /opt/splunk/etc/system/default/props.conf MAX_DAYS_HENCE = 2 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_AGO = 3600 /opt/splunk/etc/system/default/props.conf MAX_DIFF_SECS_HENCE = 604800 /opt/splunk/etc/system/default/props.conf MAX_EVENTS = 256 /opt/splunk/etc/system/local/props.conf MAX_TIMESTAMP_LOOKAHEAD = 30 /opt/splunk/etc/system/default/props.conf MUST_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_AFTER = /opt/splunk/etc/system/default/props.conf MUST_NOT_BREAK_BEFORE = /opt/splunk/etc/system/local/props.conf SEDCMD-fixfooters = s/]}//g /opt/splunk/etc/system/default/props.conf SEGMENTATION = indexing /opt/splunk/etc/system/default/props.conf SEGMENTATION-all = full /opt/splunk/etc/system/default/props.conf SEGMENTATION-inner = inner /opt/splunk/etc/system/default/props.conf SEGMENTATION-outer = outer /opt/splunk/etc/system/default/props.conf SEGMENTATION-raw = none /opt/splunk/etc/system/default/props.conf SEGMENTATION-standard = standard /opt/splunk/etc/system/local/props.conf SHOULD_LINEMERGE = false /opt/splunk/etc/system/local/props.conf TIME_FORMAT = %s%3N /opt/splunk/etc/system/local/props.conf TIME_PREFIX = "deviceTimestamp": /opt/splunk/etc/system/default/props.conf TRANSFORMS = /opt/splunk/etc/system/local/props.conf TRUNCATE = 0 /opt/splunk/etc/apps/search/local/props.conf TZ = UTC /opt/splunk/etc/apps/search/local/props.conf category = Custom /opt/splunk/etc/apps/search/local/props.conf description = dena asset_play /opt/splunk/etc/system/default/props.conf detect_trailing_nulls = false /opt/splunk/etc/system/local/props.conf disabled = false /opt/splunk/etc/system/default/props.conf maxDist = 100 /opt/splunk/etc/system/default/props.conf priority = /opt/splunk/etc/apps/search/local/props.conf pulldown_type = 1 /opt/splunk/etc/system/default/props.conf sourcetype = I'm not seeing anything obvious that looks like it would be causing a problem. But running with this configuration gives me an output that's still just a single event so there's gotta be something going on somewhere... ... View more