I'd also like to know. Other tools have this functionality. The existing splunk implementation with javascript is really complicated ... View more

I need the other fields to be back, as I need them for further calculation. I do not need _raw files - I removed _raw as _raw from the stats command, and that helped with the size of the search (now only 15mb), but still it takes 10 minutes instead of the original 5. I tried this trick with streamstats instead, but it seems that streamstats doesn't really do anything and the duplicate rows are not removed. ... View more

Hi again @ITWhisperer, I am still working with the field extraction you helped me with (super solution, thanks!), however, I am now facing a new issue - the code is too heavy to run (runs 9 minutes instead of 4, and has 300MB instead of 1MB) - this is due to the last stats command 😞 I have tried implementing a couple of solutions to this: - streamstats and eventstats - these, however, cannot properly set the data back to its original state - dedup - I thought this would be a better solution, but it turns out that dedup is even slower than stats - using eval after streamstats, but then, I would just end up using stats command again I am yet to try data model acceleration, but maybe you know another way to speed it up? In my search, I only use the fast mode.  I am not able to reduce the time-range of the search, as I have already hit the minimum time range necessary for the dashboard to be useful. Thanks! ... View more

Genius. It works. Thanks! ... View more