Also , it would be a great help if you can suggest about undefined logs and what kind these are :  Feb 17 15:41:44 SyslogAlertForwarder: ....0;;; HTTP Host == 10.10.198.187:8080;;; HTTP Response Content Type == application/javascript Last-Modified: Tue, 26 Feb 2019 16:11:46 GMT;;; " cribl_pipe = uk_mnshost = undefinedids_type = networkindex = eits_ips_prod_ussource = tcp:9997sourcetype = mcafee:nsm   Feb 17 15:41:07 SyslogAlertForwarder: ...P Response Content Type == application/octet-stream;;; " cribl_pipe = uk_mnshost = undefinedids_type = networkindex = eits_ips_prod_ussource = tcp:9997sourcetype = mcafee:nsm ... View more

Please find the sample log :   Feb 17 00:12:22 SyslogAuditLogForwarder: time="2021-02-17 00:12:22 BRT" domain="Serasa" category="Sensor" signature="Deploying updates to "spobripsgw02"." action="Set Deployment" result="succeeded" user="Administrator" comment="N/A" delta="N/A" category = Sensorcribl_pipe = br_mnshost = 10.52.225.200ids_type = networkindex = eits_ips_prod_ussignature = Deploying updates tosource = tcp:9997sourcetype = mcafee:nsm ... View more

Hi scelikok These are mcafee nsm logs not  McAfee ePO Syslog ... View more

I don't think here i can extract fields , because it's a Intrusion detection system data model and we directly get mcafee logs from tcp:9997 ... View more

Tried in all search modes still the same issue, raw event is showing "action"  , but interesting filed it's not showing action field ... View more

yes searching in verbose mode   ... View more

Okay, I will explian it simple and short : I'm searching data for Index=abc for last 2 weeks of data and I can see index percentage value is 98% events.. If I split time intervals and search like index=abc for this week and last week I can see 100% events. So, my question here is when i search data for last 2 weeks 98% events are showing, if i split time intervals and search it's showing 100% events. If data is more and due to buckets policy for last 2 weeks is it showing as 98% or is there any reason?   ... View more

Even if there is delay in _time events are getting processing , Here issue is if we run search for 10 days for raw data count of <10lacks index value is showing 100 % ... If raw data count is >10 lacks then index value is showing <100%... How can I rectify this issue ?  we have to change limit.conf for data getting from tcp:9997 port or there any other way ? ... View more

field:: * worked , Thank You so much    ... View more

Yes, after using the same search like with "*field*" , still events are missing. Under filed value count it's showing 4lack+ events , but in search filed value is showing 8 events.  ... View more

What can be that max or min delay time in events which can impact these index percentage ? ... View more

or any search command to verify timestamps , I tried index=x sourcetype=y host= source=  | convert ctime(_indextime) AS indextime | delay =_indextime-_time | table _time indextime date_zone host source sourcetype _raw it didn't worked  ... View more

Can I use https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Configuretimestamprecognition this docs to verify or you have any command or suggestions to check  ... View more

Sorry, the above search I already checked before posting here it didn't worked. Index=X source=tcp:9997 sourcetype=Y cribl_pipe=Z , for last 2 weeks of data fields are not showing 100%.  I'm searching for single index, source, sourcetype, cribl_pipe .. but I'm unable to get raw events which are not indexed  ... View more

How can I identify raw events which are not indexed source tcp:9997 port  ... View more