drilldown search in splunk notable is not capturing the original host which is mentioned in correlation search and generating 0 results how to resolve this issue.   Correlation Search: index=wineventlog host IN (AZR01PSQL19CL01, AZR01PSQL19CL02) (EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480) | eval usecase=" SQL 2019 Cluster Failover" | stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message | eval severity=case ( EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium" ) | convert ctime(firstTime) ctime(lastTime) Drilldown search index=wineventlog host=$Host$ (EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480) | eval usecase=" SQL 2019 Cluster Failover" | stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message | eval severity=case ( EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium" ) | convert ctime(firstTime) ctime(lastTime) when checking the drilldown search from splunk notable, i'm not getting any results and showing below code index=wineventlog host=aws01psplksh01 (EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480) | eval usecase=" SQL 2019 Cluster Failover" | stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message | eval severity=case ( EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium" ) | convert ctime(firstTime) ctime(lastTime) How to resolve this issue. TIA ... View more

Hi,   I need a splunk query to find the license utilization per host per day in last 4 months, to know which host/server is most noisy and utilizing most consumption in splunk. ... View more