Hi @kajalchopade071, you can check if a Forwarder is running searching in _internal index, something like this: index=_internal host=your_host if you have results, Forwarder is up and running. To check if a Forwarder is sending a kind of logs, you have to do the same thing in the index containing the logs to check. if you have many hosts to monitor, you have to create a lookup (called e.g. perimeter.csv), containing all the hosts to monitor (e.g. in a column called host) and run a little more comples search: | metasearch index=_internal | eval host=lower(host) | stats count BY host | append [ | inputlookup perimeter.csv | eval host=lower(host), count=0 | fields host count ] | stats sum(count) AS total BY host | where total=0  Ciao. Giuseppe ... View more

Hi @kajalchopade071, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Hi @kajalchopade071, usually summary indexes are used in three cases: to summarize events in a different index, in other words, you save in the summary index the results of a grouping command (e.g. stats or timechart) so, you have the already calculated values, to save only some fields and have quicker results in search because the field extarction are already present in the summary index events, To save some values of events for a period longer than retention. In other words: usually in summary indexes you don't store the full events but only elaborated results of a query. Ciao. Giuseppe ... View more

Index = your index l dedup Username | stats count by Username  Please try this.. ... View more

Hi @kajalchopade071, good for you, see next time! Ciao and happy splunking. Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Thanks 😊 ... View more

OK so imagine that I told you I wanted to get the last transaction each user had made on my system, what information would you need from me in order to be able to help me? You need to provide more information if you want to stand any chance of someone being able to help you. ... View more

suppose if i have lots of user not only 3 user so how can i used by using IN ... View more