hi @cheriemilk, Filtering on *T# and *D# is not possible in IN function as fields as it only supports asterisk ( * ) character as a wildcard in field values. You can use the where command with the match function. https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards  index=index NOT CMID IN("*T", "*D") | where NOT match(CMID, "(T|D)\d+$")   If this reply helps you, a like would be appreciated. ... View more

| eval month=strftime(_time, "%m") | stats first(_time) as visit by month, UID, module | sort visit | streamstats count by UID, module | where count = month This assumes you are starting from January so counts will be 1 in January, 2 in February, etc. if the user has visited the module at least once in all previous months. ... View more

@nickhills  I don't quite understand for 2 questions. 1. in my dashboard, there're 6 panels added which means there're 6 queries will be run at the same time when the dashboard is opened , and the metrics for 6 queries are different, but each metric is  aggregated by stats command.  do you mean I should create 6 summary index for each stats query? 2. how the summary index is stored the data? when I use sistats to ingest the data to new index, how the new index and corresponding data is saved? as the command sistats is just one-time run. Thanks, Cherie ... View more

Hi @cheriemilk  I am unable to replicate your results. Please check that you are using the latest version of splunk and if the problem still occurs, raise a support request with splunk. ... View more

your search | rex field=CAID "(?<subCAID>.*)-" | dedup subCAID ACT ... View more

@cheriemilk were you able to try and confirm the above solution? ... View more

Hi, try to set the time out duration in web.conf: [settings] splunkdConnectionTimeout = 300 I had the same issue and this fixed it while uploading the Enterprise Security App which is very large and seems to need more time. ... View more

.... | appendpipe [| eventstats first(eval("step3".mvindex(list_behavior,2))) as start, first(eval(if(mvcount(list_behavior)=3, "step4".mvindex(list_behavior,3), "exit"))) as end by UserID] Hi, @cheriemilk how about this? ... View more

Hey - so when I ran your search I hit an error with the regex so I wrote my own, and also your two 301 kf7 values have the same timestamp so you should probably figure out how you want to handle that case. That being said, something like this does get your expected output: {code} | makeresults | eval log=" 2019-12-04 18:30:08,094 # kf7=adequatT1_301 # ktf1=[liveProfile];; 2019-12-04 18:38:14,890 # kf7=adequatT1_301 # ktf1=[liveProfile,Others];; 2019-12-04 18:39:14,890 # kf7=adequatT1_301 # ktf1=[liveProfile,compensation,Others];; 2019-12-04 18:40:14,890 # kf7=adequatT1_302 # ktf1=[liveProfile,talentflag];; 2019-12-04 18:45:14,890 # kf7=adequatT1_302 # ktf1=[performance] " | makemv delim=";;" log | mvexpand log | rex field=log "(?.?)\s#\skf7=(?.)\s#\sktf1=[(?.*)]" | eval _time=strptime(timestamp, "%Y-%m-%d %H:%M:%S") | stats latest(ktf1value) as ktf1value by ktf7value | eval ktf1value=split(ktf1value, ",") | mvexpand ktf1value | stats count by ktf1value {code} I parse out the timestamp, ktf7value, and ktf1value, convert the timestamp back into the _time field as you need that for any time calls (latest/timechart/etc), take the latest ktf1value by ktf7, split out the fields to make them into a multivalue field to expand them to count by them. https://regex101.com/ is a good site for testing regex for what it's worth. Hope this helps! ... View more