Hello everyone,  i have this below SPL i am using,  index=abcde* | eval logtype = if(match(_raw,".*?LTStamp.*?ConnID.*?Exp"),"browser"," ") | eval logtype = if(match(_raw,".*?MT.*?CTime.*?MBy"),"admin"," ") | eval logtype = if(match(_raw,".*?LTStamp.*?Customer.*?SID.*?InReason"),"useractivity"," ") | eval logtype = if(match(_raw,".*?LTStamp.*?Cust.*?SID.*?SessType"),"appconnector"," ") | eval logtype = if(match(_raw,".*?LTStamp.*?Customer.*?Uname.*?SID"),"userstatus"," "), When I am using this in a search the new field "logtype" is created but the field value is just empty with count and also it is only taking the first eval statement and omitting the rest. If I use only 1 eval statement like for example 3rd eval statement "| eval logtype = if(match(_raw,".*?LTStamp.*?Customer.*?SID.*?InReason"),"useractivity"," ")" it is giving me a value "useractivity" against the newly created "logtype" field.  Now, my question is how I can join all these different eval statements into a single "eval" statement using the condition that i have used in the SPL above, [eval logtype = if(match,(regex), "X"," ")]  Note: the regexes (.*?LTStamp.*?ConnID.*?Exp) used in the match condition is hardcoded from the events we received into Splunk.   or can we use any other condition such as CASE. LIKE etc., so, that I can get all these field values (browser, adminlogs, useractivity, appconnector and userstatus) under the "logtype" field like i mentioned below. logtype  Values               count                 %  browser               xx                    xx% adminlogs           xx                    xx% useractivity        xx                    xx% appconnector   xx                    xx% userstatus           xx                   xx%   Hope the above question makes sense, any help on this will be much appreciated.  Thanks...!!! ... View more

Hello All,  When using the "stats count by column1, column2, column3, column4" I get the below result  Existing table :  column1 column2 column3 column4 XXXXXXXX YYYYY A 123 XXXXXXXX YYYYY B 123 XXXXXXXX YYYYY C 123 XXXXXXXX YYYYY D 123 XXXXXXXX YYYYY E 123   Where as I need this result : column1 column2 column3 column4 XXXXXXXX YYYYY A 123     B       C       D       E     Could somebody please help me with the query?  Thanks,  ... View more

Hello All,   We are currently getting data from an application into these 5 indexes(index1, index2, index3, index4, index5.. )  from different locations around the world.  And I want to try and create a new index called "index_global" and point all these 5 indexes to this global index so that all the data can be available under a single index.  Hope this makes sense.  I would really like to understand, how i can achieve this. Any help on this would be really appreciated.    Thanks and cheers.  ... View more