By default the metrics will only provide details on the top 10 items in a series - this applies to almost all the metrics that are collected. https://docs.splunk.com/Documentation/Splunk/8.1.3/Troubleshooting/Aboutmetricslog The way to address this, is to change the limit applied using the limits.conf file - the following stanza added to a indexer / HF will increase the number of items which are tracked [metrics] maxseries = 50 interval = 60 This will ensure the top 50 items are included - so you can adjust this to reflect the likely number of sourcetypes if that is the main metric to be tracked The "interval" reference allows you to change the frequency that this data is collected to control the volume of data generated in the log. In the same, the frequency is 60seconds to allow minute by minute tracking - but that may be excessive for some purposes. ... View more

Looks like you want to use the regex command. "Removes or keeps results that match the specified regular expression." http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Regex ... View more

After some more discovery, this concept has been established as an FAQ ... View more

Does your event-stream have the _time field available prior to invocation of the transaction command? It might be most convenient to check with ... | eval test_time=_time where ... is your full search string up to the point of transaction. At this point you can use the field inspection tools on test_time. One possibility is that all these events got timestamped with the current time, (DATE_CONFIG=current) and were loaded in as historical data.. or something along those lines. It seems a bit unlikely given the recent nature of these events, but not sure what's going on so far. ... View more

I think that the "advanced charting view" sideview is mentioning is deprecated? Please correct me if I'm wrong. ... View more