Hi All, i am using below query to get the common results on the basis of correlation_id but it is very slow,I need to optimize it to get the proper results     index=kong_fincrimekyc_prod |rename request.headers.x-int-clientapplication as "client" correlation-id as "correlation_id" |table Error_Reason,correlation_id,client,upstream_uri|where isnotnull(client) |join type=outer correlation_id [ search index=fincrimekyc_prod source="prod-ms-vix-adapter" sourcetype=kyc_app_logs "com.nab.ms.vix.adapter.exception.VixExceptionHandler" "ERROR" OR "Exception" | rex "Caused by(?<Error_Reason>.*?)\\\n" | rex "correlation_id=\\\"(?<correlation_id>.*?)\\\"\,"|table Error_Reason,correlation_id] |stats values(Error_Reason) as "Error_Reason" values(client) values(correlation_id) by upstream_uri|where isnotnull(Error_Reason)     Please help on this Thanks ... View more

Hi All, I am working on search to search fields values from the lookup in an index and i have created the below search : index="nch_apps_nonprod" [| inputlookup WAS_ErrorCode.csv | table WASEventCode | rename WASEventCode as query] | append [| inputlookup WAS_ErrorCode.csv | stats values(WASEventCode) as WASEventCode] | eventstats values(WASEventCode) as WASEventCode | where isnotnull(_raw) | eval WASEventCode=mvmap(WASEventCode,if(match(_raw,WASEventCode),WASEventCode,null())) | eventstats count as Ecount by WASEventCode | convert ctime(_time) as time| dedup WASEventCode|lookup WAS_ErrorCode.csv WASEventCode OUTPUT Severity2 Description2 Threshold2 WASEventCode | eval Threshold2=mvindex(Threshold2,0) | eval Severity2=mvindex(Severity2,0)| eval Description2=mvindex(Description2,0) | eval WASEventCode=mvindex(WASEventCode,0) | where Ecount>Threshold2 |eval message="mc_host= "+host+"; mc_object= "+source+"; mc_object_class= "+sourcetype+"; mc_origin= "+host+"; msg='"+WASEventCode+" : "+Description2+" with count as "+Ecount+"'; mc_tool_time= "+time+"; mc_origin_sev= "+Severity2+";"|table message   In the above search , i am searching  field values, WASEventcode from the lookup in index.Please note that this field in not present in index and i am doing text search and it is working fine.Now i want to search the condition which would search another field value from the lookup and it should search both field values which is Description2 of the WASEventcode but not able to do the same ... View more

Hi Everyone, I am using the collect command to write data in summary index and it is giving the values properly when i run the search manually before using collect command but when i put the collect command the values become 0.     Attached are the screenshots before collect and the job results of saved search If anyone has idea on this pls let me know.     Thanks ... View more

Hi Everyone, I have below query by which i am extracting manager name,email etc. by applying join on managerno to all employee records since manager will also be a part of it.This query is taking 120 sec to execute but i need to minimize and keep it under 20 seconds.Any help will be appreciated.   index="myid_transac_idx" sourcetype="myID_Identity" earliest=-1d@d latest=now() |fields employeeno display_name loginid email status managerno Termination_process_date |where status="Terminated" and Termination_process_date > "2022-10-01 00:00:00.00" |join type=LEFT managerno [ search index="myid_transac_idx" sourcetype="myID_Identity" earliest=-1d@d latest=now() |fields employeeno display_name loginid email status |rename employeeno as managerno |rename display_name as manager_name |rename loginid as managerloginid |rename email as manageremail |rename status as managerstatus]|fields employeeno display_name loginid email status managerno manager_name managerloginid manageremail managerstatus | table employeeno display_name loginid email status managerno manager_name managerloginid manageremail managerstatus   ... View more

Hi Everyone, I need to know if is it possible to get the data via HEC from a source to two different Splunk instances?Currently, the source is sending data to one Splunk instance and I want to test the same on a different Splunk environment by getting the data in   Thanks ... View more

Hi Everyone, I am trying to ingest the change related data from database using DB connect and using the rising column to ingest the same. I have specified the changerequestID as the rising column. Data has other fields as well such as creationtime,Lastmodifiedtime,Solvedtime etc.If a change is open then the entry in the database for column values such as LastModifiedtime,Solvedtime can be blank so in that case my query is if the these values get updated in the DB after sometime but since the entry before updating has already been ingested in splunk via rising column then will it get ingested in splunk? Thanks ... View more

Hi Everyone, I am getting big single event through a python script from an API containing the performance data from an API but it is not autoextracting all the KV fields and i need to get those details to get the meaningful data.Also the timestamp is coming in epoch format.Below is the event format :   {'d': {'__count': '0', 'results': [{'ID': '6085', 'Name': 'device1', 'DisplayName': None, 'DisplayDescription': None, 'cpumfs': {'results': [{'ID': '6117', 'Timestamp': '1649157300', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649157600', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649157900', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649158200', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649158500', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649158800', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649159100', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649159400', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649159700', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649160000', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}, {'ID': '6117', 'Timestamp': '1649160300', 'DeviceItemID': '6085', 'pct_im_Utilization': '4.0'}, {'ID': '6117', 'Timestamp': '1649160600', 'DeviceItemID': '6085', 'pct_im_Utilization': '1.0'}]}, 'memorymfs': {'results': [{'ID': '6118', 'Timestamp': '1649157300', 'DeviceItemID': '6085', 'im_Free': '2.809298944E9', 'pct_im_Utilization': '83.0702196963489'}, {'ID': '6118', 'Timestamp': '1649157600', 'DeviceItemID': '6085', 'im_Free': '2.741796864E9', 'pct_im_Utilization': '83.4770099337781'}, {'ID': '6118', 'Timestamp': '1649157900', 'DeviceItemID': '6085', 'im_Free': '2.784014336E9', 'pct_im_Utilization': '83.2225932482694'}, {'ID': '6118', 'Timestamp': '1649158200', 'DeviceItemID': '6085', 'im_Free': '2.739892224E9', 'pct_im_Utilization': '83.4884879350163'}, {'ID': '6118', 'Timestamp': '1649158500', 'DeviceItemID': '6085', 'im_Free': '2.812264448E9', 'pct_im_Utilization': '83.0523485718404'}, {'ID': '6118', 'Timestamp': '1649158800', 'DeviceItemID': '6085', 'im_Free': '2.747793408E9', 'pct_im_Utilization': '83.4408727427832'}, {'ID': '6118', 'Timestamp': '1649159100', 'DeviceItemID': '6085', 'im_Free': '2.808725504E9', 'pct_im_Utilization': '83.0736754386571'}, {'ID': '6118', 'Timestamp': '1649159400', 'DeviceItemID': '6085', 'im_Free': '2.744528896E9', 'pct_im_Utilization': '83.4605457900666'}, {'ID': '6118', 'Timestamp': '1649159700', 'DeviceItemID': '6085', 'im_Free': '2.804084736E9', 'pct_im_Utilization': '83.1016422674804'}, {'ID': '6118', 'Timestamp': '1649160000', 'DeviceItemID': '6085', 'im_Free': '2.740002816E9', 'pct_im_Utilization': '83.4878214704282'}, {'ID': '6118', 'Timestamp': '1649160300', 'DeviceItemID': '6085', 'im_Free': '2.7926528E9', 'pct_im_Utilization': '83.1705349587829'}, {'ID': '6118', 'Timestamp': '1649160600', 'DeviceItemID': '6085', 'im_Free': '2.736328704E9', 'pct_im_Utilization': '83.5099629050747'}]}} In the above event , it is displaying CPU , memory utilization multiple times at different epoch times for each device.I have removed the trailing event containing data for other devices as it was exceeding the forum limit to post.I need to get the utilization data device wise.Please help on this.   Thanks ... View more