Do the resulting files from a "dump" command have a TTL? I think they must since the files I created on Friday no longer exist. Here is the search I am using to create the files.   index = “myIndexName” sourcetype=”mySourcetype” myFilterField IN(123ABC, 456DEF, 789GHI) | dump basefilename= ABCCorp_06-06-22_0800_01330_ rollsize=1000 compress=5 format=raw | table *     Thank you. ... View more

All, Will INDEXED_EXTRACTIONS = JSON perform the extractions on an All-in-One platform? Here is my props.conf The sourcetype was executed but none of the fields were extracted. I can see the fields & values in _raw but they are not listed as fields. Here is what I see with an adhoc search. The time "field" within _raw is Jan 5, 2022 I did index the data on 2/22/22 but I am uncertain where the _time field came from. It matches nothing in the data.       props.conf (no transforms.conf) # created on 2/22/2022 for a test case using INDEXED_EXTRACTIONS=JSON # The non-highlighted settings are identical to a known working stanza for the exact same data [allfields_index_extracted] INDEXED_EXTRACTIONS = JSON NO_BINARY_CHECK = true LINE_BREAKER = ([\r\n]+) EVENT_BREAKER = ([\r\n]+) EVENT_BREAKER_ENABLE = true SHOULD_LINEMERGE = false TIME_PREFIX = ^"?{""?time""?: TIME_FORMAT = %s.%6N MAX_TIMESTAMP_LOOKAHEAD = 17 category = Structured description = INDEXED_EXTRACTIONS eq JSON pulldown_type = 1 # Search Time stuff # Disable search time field extractions since INDEXED_EXTRACTIONS=JSON KV_MODE = none AUTO_KV_JSON = false disabled = false  Appreciate the help!     ... View more

My long set of SPL starts with the typical filtering on the primary search line. It then uses various eval, foreach, streamstats and eventstats commands to process the data for a big stats aggregation command. Here is the problem or at least a gap in my misunderstanding: Early in the SPL I use a "| where" command to eliminate events not containing a specific value. This works great. The results filter down to 351,513 events. However, between this where command and the line just before the big stats command, I only use eval, foreach, streamstats and eventstats commands ... and the search results increase by 29. I thought each of these commands merely modified / created fields within the events. There are now 351,532 events instead of the 351,513 events. So the question is ... Can an eval, foreach, streamstats or eventstats ever INCREASE the number of search results or am I just misinterpreting the results. ... View more

Code Architecture: common code generating initial results; generate unique key for each grouping multireport or appendpipe        stanza 1 with its own set of stats, evals, etc.; uses the key from the common code      stanza 2 with its own set of stats, evals, etc.; uses the key from the common code Aggregates the resulting data from the common, stanza1, stanza2 results using the key Issue Statement common code + stanza 1 takes about 1 min to execute common code + stanza 2 takes about 1 min to execute common code + stanza 1 + stanza2 using either a multireport or appendpipe takes about 17 min [Q] Does this huge execution time difference make sense? I have attached a few images to show how I think multireport and appendpipe work. [Q] Is my understanding accurate?   The pre-appendpipe SPL reads the data from the index, filters the data, creates some initial fields using streamstats and eventstats and creates a key that is unique per the overall groupings correlated within this code. Lines 1 and 2 are identical and originate from the pre-multireport SPL. These results are presented to the stanza1 and stanza2 SPL. Lines 3 and 4 are independent results from stanza1 and stanza2 respectively stanza1 and stanza2 execute mutually exclusive from one another The sort and stats clauses within stanza1 and stanza2 are quite different but the one does NOT impact the other. The final aggregation software ties all the data together based on a common key.   The pre-appendpipe SPL reads the data from the index, filters the data, creates some initial fields using streamstats and eventstats and creates a key that is unique per the overall groupings correlated within this code. Lines 1 and 2 and 3 are identical and originate from the pre-appendpipe SPL. These results are presented to the stanza1 and stanza2 SPL. Lines 3 and 4 CAN be removed if I filter the input data with a where clause and the flag I called "which" associated with each set of data. Lines 5 and 6 are independent results from stanza1 and stanza2 respectively stanza1 and stanza2 execute mutually exclusive from one another. The stats clauses within stanza1 and stanza2 are quite different but the one does NOT impact the other. The final aggregation software ties all the data together based on a common key.   ... View more