Thank you all for your reply! it helps! ... View more

1. Don't use the _json sourcetype. If needed, create a new one copying settings from the _json. 2. Don't use indexed extractions unless you're absolutely sure what you're doing. 3. Don't edit the _json sourcetype - it's a builtin sourcetype which shouldn't be used explicitly anyway (see p.1) 4. The count(field) aggregation counts single values so if you have multivalued fields it's normal to have count(field) higher than a general event count. In your case you probably (as @gcusello already pointed out) have multiple occurrences of a "timestamp" field within a single event so it gets parsed as multivalued field and gets counted accordingly. ... View more

Hi @Iris_Pi , the first solution requires that you always have both fwname and interface fields. Ciao. Giuseppe ... View more

One caveat though - the host field might be being parsed out from the raw message during ingestion. In such case you can't use it for specifying props stanza. ... View more

Use this query to find out which indexes are used by a data model. | tstats count from datamodel=foo by index ... View more

Hello Pickle, thanks much for the help! I'm using the raw endpoint and I can set the host by using the host parameter now.   ... View more

Thanks @PickleRick for the detailed explanation! it's very helpful 🙂 ... View more

Hi @Iris_Pi , good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated 😉 ... View more

Thanks much for the reply, it works now! ... View more