I'm assuming you are comparing EXTRACT- with REPORT- (not TRANSFORMS- ) * If the same regex for either, see https://answers.splunk.com/answers/10945/performance-of-extract-vs-report-for-same-regex.html If comparing one long regex with numerous short regexes, I have not heard an answer to that. Also, in this case if you are dealing with CSV or any delimited data, you can instead use FIELDS and DELIMS . * as indexed vs search-time fields are another discussion, as are INDEXED_EXTRACTIONS for CSV. ... View more

See my answer above, and the comments beneath it. ... View more

you're welcome - seems like syslog hasn't changed very much over the years ... View more

You're welcome. This reminded to update the listing to show it works with the latest versions of Splunk. ... View more

Yes, thanks, just noticed that - though <option name="fields"> still works, it will be flagged as deprecated by the nice new xml editor. Updated post. ... View more

Why are you using transpose? (It's implemented in python and not the fastest search command.) If the question is "what is the average length of each cookie throughout my events, by cookie name?" then foreach is enough, assuming they all start with ck_*: | foreach ck_* [eval len_<<FIELD>>=len(<<FIELD>>)] | stats avg(len_ck_*) Full search example: | stats count | fields - count | eval ck_1="abc", ck_2="bcdef", ck_3="g" | eval event="e1|e2" | makemv delim="|" event | mvexpand event | eval ck_3=if(event=="e2", "ghi", ck_3) | foreach ck_* [eval len_<<FIELD>>=len(<<FIELD>>)] | stats avg(len_ck_*) ck_1 ck_2 ck_3 event abc bcdef g e1 abc bcdef ghi e2 avg(len_ck_1) avg(len_ck_2) avg(len_ck_3) 3.000000 5.000000 2.000000 ... View more

Here's an idea, based on Lowell's answer above. Create a list of fields from events ( |stats values(*) as * ) and feed it to map to test whether field::value works - implying it's at least a pseudo-indexed field. index=youridx | dedup 25 sourcetype get some events, assuming 25 per sourcetype is enough to get all field names with an example | head 100 assume there are only 4 sourcetypes in the index | stats first(*) as * make a list of all fields with their examples (one event, lots of fields) | fields - date_* tag::* get rid of some fields we don't care about testing | transpose turn those fields into events | rename "row 1" as row get rid of that space | map maxsearches=20 search="search index=youridx $column$::$row$ | head 1 | eval indexed=\"$column$\" | table indexed" run up to 20 searches (against the first 20 fields) that go back and search that index for name::value - if found, output an event and populate the field named "indexed" with the field tested. If name::value fails, 0 rows are output, so you end up with a list of likely indexed fields. From my random dataset, it found index linecount sourcetype tag timeendpos timestartpos , but for some reason did not find punct nor source even though they contained had no spaces. Perhaps due to slashes or other special characters that name::value doesn't like. name::"value" doesn't seem to work at all. So, YMMV. ... View more

It is best to not post additional questions in the answer section. Post them as a question so they get proper visibility. /g means globally - it will replace every instance of the subject that it finds, not just the first one. s/-//g would swap app dash with nothing. but if you did s/-// with no g, you would end up with xxxxxx-xxxx. ... View more

As of Splunk 6.3 and later, there is now an optional attribute crossServerChecksum in serverclass.conf. Default is false - the old way - so your upgrade to 6.3.x+ doesn't immediately resend all apps to all clients. But if set to true it uses a different algorithm (which does not include timestamps and such) to make a DS react the same as another - so they can sit behind a load balancer. ... View more

This is the situation crossServerChecksum should fix. ... View more

And if you want to include the actual search text, for analysis of what rules use what data sources for example, you can extend this answer to: | rest /services/alerts/correlationsearches | rename eai:acl.app as app, title as csearch_name | join type=outer app csearch_name [ rest /services/saved/searches | rename eai:acl.app as app, title as csearch_name search as csearch | table app csearch_name csearch ] | table app security_domain csearch_name description csearch ... View more

I'm on the cli of the indexer, not the cluster master. as indexers aren't search peers of the cluster master, the above rest command won't work. Thanks though. ... View more