Actually now I tried below search for find the deference between two fields that the results separated by "," not by "-", see the search and results for the fields below: current_conf field: _URL_Value:http://0wl0jql1h.energosberezhenie.com/*,http://post5.vkrugudruzei.ru,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app/*,http://173.208.96.43/,http://survey-smiles.com,https://survey-smiles.com,https://spl-notofocation.tempurl.host/*,https://email.notify.thinkific.com/c/*,https://use.typekit.net/af/*,https://mandrillapp.com/track/click/30195602/*,https://soporte-chilos.tempurl.host/*,https://cloudflare.hcaptcha.com,http://cloudflare.hcaptcha.com,https://6pke47.codesandbox.io,http://6pke47.codesandbox.io,https://boofxvacpc63a506565edb7.segopet.ru,http://boofxvacpc63a506565edb7.segopet.ru,http://bitsnpieces.be/*,https://quickentrance.com/pokke/*,https://quickentrance.com/portalspl/*,https://portalspl.ddns.net/*,http://ww1.goofle.com/*,https://ww1.goofle.com/*,http://coupons.com/*,https://coupons.com/*,http://print.coupons.com/*,https://print.coupons.com/*,https://nrezirn.com,https://65r4prji.r.us-west-2.awstrack.me,http://mrkzgulfup.com,http://dlupload.com,http://hssonee.wap.sh4shared,http://top4top.io,http://imagesupload.org,http://www.jo1sat.net,http://up.djelfa.info,http://up.3raq4all.com,http://upload.chjoy.com,http://up-9.com,http://www.gulf-up.com,http://upload.hawamer.com,http://www.i2pdf.com,http://www.zamzar.com,http://www.duplichecker.com,http://theonlineconverter.com,http://www.foxit.com,http://www.id4arab.com,http://www.camscanner.com,http://www.pdf-suite.com,http://pdf.wondershare.com,http://png2pdf.com,http://pdf2png.com,http://www.pdfmate.com,http://www.web2pdfconvert.com,http://bitsnpieces.be/,https://chedid-insurance-shared-0utlook.firebaseapp.com/,https://chedid-insurance-shared-0utlook.firebaseapp.com,https://mxtkkh79df637a616f5d109.repstara.ru/id-63a40b311d9c3,https://mxtkkh79df637a616f5d109.repstara.ru,http://img6.wsimg.com,http://chedid-insurance-shared-0utlook.firebaseapp.com,http://mxtkkh79df637a616f5d109.repstara.ru,http://nesaih.co.za/*,https://tawangmang.ru/*,https://attach.mail.daum.net/bigfile/v1/urls/fd/_qloddhfj3pazipqgta7u0grwye/a3h7zdglhcstmgl0pq3q0q,https://attach.mail.daum.net/bigfile/v1/urls/d/_qloddhfj3pazipqgta7u0grwye/f3nwh6txiwi2v_hzvt74zw,https://t.ly/-r-b,http://r3.o.lencr.org/,https://linkunshorten.com/?url=https%3a%2f%2fvancouveredu.com%2fsecure%2f&sitenotsafe=true,https://vancouveredu.com/secure/&sitenotsafe=true,https://vancouveredu.com/secure/,http://196.224.96.4   previous_conf field:   _URL_Value:http://0wl0jql1h.energosberezhenie.com/*,http://post5.vkrugudruzei.ru,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app,https://ath-365-folder-0utlook.web.appyuci7nr4cp63857abfc58f7.tukoapps.ruath-365-folder-0utlook.web.app/*,http://173.208.96.43/,http://survey-smiles.com,https://survey-smiles.com,https://spl-notofocation.tempurl.host/*,https://email.notify.thinkific.com/c/*,https://use.typekit.net/af/*,https://mandrillapp.com/track/click/30195602/*,https://soporte-chilos.tempurl.host/*,https://cloudflare.hcaptcha.com,http://cloudflare.hcaptcha.com,https://6pke47.codesandbox.io,http://6pke47.codesandbox.io,https://boofxvacpc63a506565edb7.segopet.ru,http://boofxvacpc63a506565edb7.segopet.ru,http://bitsnpieces.be/*,https://quickentrance.com/pokke/*,https://quickentrance.com/portalspl/*,https://portalspl.ddns.net/*,http://ww1.goofle.com/*,https://ww1.goofle.com/*,http://coupons.com/*,https://coupons.com/*,http://print.coupons.com/*,https://print.coupons.com/*,https://nrezirn.com,https://65r4prji.r.us-west-2.awstrack.me,http://mrkzgulfup.com,http://dlupload.com,http://hssonee.wap.sh4shared,http://top4top.io,http://imagesupload.org,http://www.jo1sat.net,http://up.djelfa.info,http://up.3raq4all.com,http://upload.chjoy.com,http://up-9.com,http://www.gulf-up.com,http://upload.hawamer.com,http://www.i2pdf.com,http://www.zamzar.com,http://www.duplichecker.com,http://theonlineconverter.com,http://www.foxit.com,http://www.id4arab.com,http://www.camscanner.com,http://www.pdf-suite.com,http://pdf.wondershare.com,http://png2pdf.com,http://pdf2png.com,http://www.pdfmate.com,http://www.web2pdfconvert.com,http://bitsnpieces.be/,https://chedid-insurance-shared-0utlook.firebaseapp.com/,https://chedid-insurance-shared-0utlook.firebaseapp.com,https://mxtkkh79df637a616f5d109.repstara.ru/id-63a40b311d9c3,https://mxtkkh79df637a616f5d109.repstara.ru,http://img6.wsimg.com,http://chedid-insurance-shared-0utlook.firebaseapp.com,http://mxtkkh79df637a616f5d109.repstara.ru,http://nesaih.co.za/*,https://tawangmang.ru/*,https://attach.mail.daum.net/bigfile/v1/urls/fd/_qloddhfj3pazipqgta7u0grwye/a3h7zdglhcstmgl0pq3q0q,https://attach.mail.daum.net/bigfile/v1/urls/d/_qloddhfj3pazipqgta7u0grwye/f3nwh6txiwi2v_hzvt74zw   Search query: my search | rex field=current_conf "(?<h>[^)]+)" | eval SESSION_A=split(h,",") | mvexpand SESSION_A | rex field=previous_conf "(?<B>[^)]+)" | eval SESSION_B=split(B,",") | mvexpand SESSION_B | where isnotnull(SESSION_A) | where isnotnull(SESSION_B) | stats count,list(SESSION_A) as SESSION_A,list(SESSION_B) as SESSION_B by current_conf previous_conf | where SESSION_B!=SESSION_A     But the search is not work.   Please your support. ... View more

Yes, then, please share with me the full search.     Thank you ... View more

Ok Mr, after extract, what is the next step. ... View more

Hi, current_conf field: _Name:REQ000004543448-4614240-shrepoint previous_conf field: _Name:REQ000004543448-shrepoint   Yes I understood you, we just need to know the different number between two fields, that it is "4614240" without - end and beginning.  So can we do that or, it is not? ... View more

Why not  "4614240-" or  "-4614240"? No problem, we can show the field result with "-" in the begging or end, it is not big deal.   Regarding the others below questions, only need to show the deference between two fields.    Best Regards, ... View more

Hi @ITWhisperer. The results that I need from my example, create new field contain the deference between two fields that it is "4614240".   current_conf field: _Name:REQ000004543448-4614240-shrepoint previous_conf field: _Name:REQ000004543448-shrepoint   Best Regards, ... View more

Hi Richgalloway, Thank you for your reply, but I think you can create new regular expression and create new field for the data model by editing the data model, then we can use this field. Regads, ... View more

Hi @richgalloway  Only I can see below errors on splunkd.log for one of SHC. 10-31-2022 09:07:59.779 +0300 WARN ConfMetrics [173553 ConfReplicationThread] - single_action=PUSH_TO took wallclock_ms=28816! Consider a lower value of conf_replication_max_push_count in server.conf on all members 10-31-2022 09:08:15.562 +0300 WARN HttpListener [208689 HttpDedicatedIoThread-1] - Socket error from 127.0.0.1:49198 while accessing //servicesNS/nobody/splunk_secure_gateway/data/inputs/ssg_enable_modular_input/default/disable: Broken pipe 1 10-31-2022 09:08:20.433 +0300 WARN LocalAppsAdminHandler [100239 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.477 +0300 WARN LocalAppsAdminHandler [9534 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.513 +0300 WARN LocalAppsAdminHandler [34267 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.518 +0300 WARN LocalAppsAdminHandler [157525 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.558 +0300 WARN LocalAppsAdminHandler [165755 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.606 +0300 WARN LocalAppsAdminHandler [103480 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.609 +0300 WARN ConfReplicationThread [173553 ConfReplicationThread] - Error pushing configurations to captain=https://10.99.19.24:8089, consecutiveErrors=1 msg="Error in acceptPush: Non-200 status_code=400: ConfReplicationException: Cannot accept push with outdated_baseline_op_id=b171c01b88a8b8e9c8f9db9dbfcfb367de3ff073; current_baseline_op_id=a6fdcc3a9e93aa6d64c63fdc43005bc11210a972" 10-31-2022 09:08:20.617 +0300 WARN LocalAppsAdminHandler [34267 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.634 +0300 WARN LocalAppsAdminHandler [245085 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.640 +0300 WARN LocalAppsAdminHandler [34267 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.647 +0300 WARN LocalAppsAdminHandler [137654 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.852 +0300 WARN LocalAppsAdminHandler [100022 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.885 +0300 WARN LocalAppsAdminHandler [100022 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:20.955 +0300 WARN LocalAppsAdminHandler [7721 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.073 +0300 WARN LocalAppsAdminHandler [73456 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.077 +0300 WARN LocalAppsAdminHandler [127923 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.085 +0300 WARN LocalAppsAdminHandler [65584 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.280 +0300 WARN LocalAppsAdminHandler [179686 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.365 +0300 WARN LocalAppsAdminHandler [179686 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.368 +0300 WARN LocalAppsAdminHandler [99705 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.422 +0300 WARN LocalAppsAdminHandler [103480 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.430 +0300 INFO AutoLoadBalancedConnectionStrategy [199471 TcpOutEloop] - Connected to idx=10.99.19.32:9997:0, pset=0, reuse=0. autoBatch=1 10-31-2022 09:08:21.446 +0300 WARN LocalAppsAdminHandler [102067 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.451 +0300 WARN LocalAppsAdminHandler [100239 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.454 +0300 WARN LocalAppsAdminHandler [128022 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.459 +0300 WARN LocalAppsAdminHandler [103480 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.493 +0300 WARN LocalAppsAdminHandler [116746 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.512 +0300 WARN LocalAppsAdminHandler [116746 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf 10-31-2022 09:08:21.545 +0300 WARN LocalAppsAdminHandler [116746 TcpChannelThread] - Using deprecated capabilities for write: admin_all_objects or edit_local_apps. See enable_install_apps in limits.conf   Regards, ... View more

Hi, The version for Splunkforwarder that I tried to install it is 6.6.12.1, but appeared the same error.   Regards, ... View more

Hi, Thank you. I tried to install Splunk version 6.X.X, the same error appeared, but the same first error.   Regards ... View more

Thanks Mr.   Already I tried to install version 7.x.x but appeared this error in screen shot.     ... View more

@ITWhisperer Thank you for your support. ... View more