One way is using SEDCMD.  Add this to the appropriate props.conf file: [mysourcetype] SEDCMD-rmJSONprefix = s/^[^\{]+?//   ... View more

Thank you. Issue resolved after using base search. Was able to identified the issue. ... View more

Try this (index=aws sourcetype=aws:cloudtrail eventName=RebootInstances) OR (index=aws sourcetype=aws:description source="us-east-2:ec2_instances") | eval id=coalesce(id, 'requestParameters.instancesSet.items{}.instanceId') | eval _time=if(sourcetype="aws:cloudtrail", _time, null()) | fields _time userName sourceIPAddress private_ip_address id | stats values(*) as * by id  It searches both data sets. id is then set as either id OR the instanceId in the coalesce statement. _time is set to null if it is the description sourcetype, forcing _time to come from the cloudtrail event fields are then limited to the ones specified stats takes the values of all fields and effectively merges the data on the id field Hope this helps   ... View more

Thank you for your assistance. That query works. My only concern with using NOT instead of "!=" is that NOT will bring back all rows even if TRAN_CLASS=' '. Plus TRAN_CLASS is not a field in "ar:mdm" and just using "!=" will affect respTime. ... View more

Great !! Appreciate if you could accept as solution....:) ... View more

Write a coldToFrozenScript.  This script is invoked by Splunk when a bucket is due to be archived.  See 'coldToFrozenScript ' in the Admin manual (https://docs.splunk.com/Documentation/Splunk/8.1.1/Admin/Indexesconf#indexes.conf.spec) ... View more