Hi @Splunk4, as I said, to debug your search you can have two approach: starting by the beginning or by the end. Starting from the end, you have to remove, one by one, a complete row understanding if there's some blocking command and/or analyzing if there are all the fields, e.g., in your case, at first delete the last where command to see if it causes the null result, then you have two following stats command, check if the key of the second is present on the first and what are the values. Starting from the beginning run the main search (with both the indexes and see if you have all the fields to use in the following commands, especially the BY clauses in stats commands. Ciao. Giuseppe ... View more

@Splunk4 - Try this instead: index="nch_apps_nonprod" [| inputlookup WAS_ErrorCode.csv | table WASEventCode | return $WASEventCode] Appending $ makes text search instead of field search.   I hope this helps!!! ... View more

This search was working fine earlier and results were coming properly.What i have noticed that the other this search running from one of the search head and due to which it might not be working while the other searches run from another search head and they are working fine.I am not sure how to check on this thing.   Thanks ... View more

Thanks,,will try through lookup option since the data is not small ... View more

It's working fine for the events without spaces now and for events with spaces,there are some events(not all) which i highlighted earlier,not working.Below is the one   Alert :: Critical :: NXUSWSSW01 :: SW-MIB:swDeviceStatusTrap : swFCPortSpecifier.43 = 42, swDeviceStatus.43 = login(1), swEndDevicePortID.43 = AAEqKQ==, swNsNodeName.43 = ÀPv lð, swNsPortName.43 = ÀPv lð, sysUpTime = 11 days 19 hours 0 minutes 0.04 second, experimental.1057.1.0 = 10.80.248.71, snmpTrapEnterprise = SW-MIB:sw :: Storage Traps   Not sure what could be the issue. ... View more

The column used as the Rising Column must change every time that row is modified.  If it does not change then Splunk will not read that row and the new data will not be indexed. ... View more

Can someone help me with the props configuration for this.I am trying to use below but its not working. LINE_BREAKER = (,){"id": INDEXED_EXTRACTIONS=json KV_MODE=none SHOULD_LINEMERGE=true disabled=false pulldown_type=true   I am trying to break the events starting with id ... View more