Hi @daisy_st  The ITEW/ITSI comes with an internal license which is used for the itsi_* sourcetypes, this means it wont count towards any other license you have. To unlock ITEW into ITSI you do need a separate license key, however it sounds like this isnt an issue for you. Relating to the 500 error(s) - Is there anything else you can see around this?  * In the browser developer tools window, under Network, can you see the status=500 pages? Is there any response content for those api calls? * In the _internal index have a search for log_level=error "itsi"  and/or look around in the $SPLUNK_HOME/var/log/splunk/*itsi* files to see if that gives any clues - feel free to post any specific error logs here to help us diagnose. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more

What is wrong with what @daisy_st  suggested? One reason it might not be working is that the information you provided is not your actual raw event. If that is the case, please provide some real examples. Another possibility is that you are not looking for search time / SPL extraction but you want to know how to extract this at indexing time. Please can you clarify? ... View more

hi, I actually found another workaround. The point was to get the specific status as part of each transaction included transaction and afterwards getting the data back in raw event format with matching events only. For example, all events for transactions which contain ERROR code need to be displayed, even if the given event doesn't contain the code but the transaction does. Thanks for making me check further eventstats, that helped. index=x OR index=y OR index=z | eventstats count(eval(Status="A")) AS Count_Status list(Status) AS VALUES min(_time) AS min_time BY ID| where Count_Status>0   ... View more