Try like this your current search giving fields Host and Has* fields | replace "TRUE" with 1 in Has* | addtotals label="NumTRUE" | replace "1" with "TRUE" in Has* | replace "FALSE" with 1 in Has* | addtotals label="NumFalse" | replace "1" with "False" in Has* Alternatively your current search giving fields Host and Has* fields | untable Host key value | appendpipe [stats count by Host value | replace "TRUE" with "NumTRUE" "FALSE" with "NumFalse" in value | rename value as key | rename count as value] | xyseries Host key value | table Host Has* NumTRUE NumFALSE ... View more

You could always do it like this: https://answers.splunk.com/answers/268433/data-input-path-name-is-the-same.html ... View more

Make sure you set this for your sourcetype in props.conf : [YourSourcetypeHere] LINE_BREAKER=(\Z) TRUNCATE=500000 SHOULD_LINEMERGE = 1 This will treat the entire file as a single event and then it should work as you expect. Deploy this to the Indexers (or Heavy Forwarders) and restart all splunk instances there. This will apply ONLY TO FUTURE EVENTS (the scripts that are already there have already been processed) so you will have to create new files in order to test this. ... View more