You may take a look at below to see the detailed info on changing Splunk DB location and copying the data from existing directory to new. https://pandeysumitsolutions.blogspot.com/2023/05/changing-splunk-db-location-if-our.html Blog link - http://sumitpandey.co.in  ... View more

You should not use index-time extractions unless you have a very good reason for doing so and really know what you're doing. Index-time extractions affect performance negatively. You should always use search-time extractions unless there's a specific reason for not doing so. This blog post covers the problem you might be running into: http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/ ... View more

One more twist. How do I show this in a time chart? ... View more