My apologies for not making the question as specific as it needed to be for the assist, I'm still trying to learn what the questions are and how to ask them. mrunals, that is pretty close to what I'm looking for and possibly because my question was asked incorrectly, I'll try to rephrase the question. Users can login multiple times a day and query the database multiple times a day. So, the users name will appear in the log numerous times in a day sometime up to 50 times, so uniqueness of the user is important but also the number of logins as this would determine the ranking of the users. I'm trying to show how many times in a month/week/year that Fred/Mary/George have logged in and the databases that they have logged into, displaying the top 15 users for each database, by ranking. In a 7day look I would anticipate seeing all the databases listed with the top 15 users, most users will have logged in daily and would have a count of 7, others less. The ranking (number of time Fred is in the log for the day) would help determine the top users (Fred logged in multiple times and Mary only once so Fred would be ranked higher than Mary). Hopefully this helps better describe what I'm trying to accomplish. mrunals, can you help me understand how your suggestion is supposed to work? bin, is that getting a unique set of data for 1day then getting distinct (_time) and counting? shouldn't changing the span from 1d to 7d cause UniqueDays to be 7 instead of 1? Thanks, ... View more

Thanks for the reply but I don't think those are giving the results I was expecting. In a 7day query each user potentially would have a maximum of 7 days but the counts being retrieved are considerably higher than that leading me to believe they aren't counting unique users for the day ... View more

It appears to be executing... ... 2018-05-01 06:00:07.410 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' started 2018-05-01 06:00:07.411 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' stopping 2018-05-01 06:00:07.418 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' finished with status: COMPLETED Can I see a record count of records that are or are not ingested? and if I can't can I manually execute the job? ... View more

Ah, thanks I was looking for that... ... View more

Just a follow up in case someone else runs into this.. removing the comment "--check for blank CLOB" fixed the issue. AND LENGTH(p."Value") > 0 --check for blank CLOB Adam, ... View more

Just a follow up in case someone else runs into this.. removing the comment "--check for blank CLOB" fixed the issue. AND LENGTH(p."Value") > 0 --check for blank CLOB Adam, ... View more

The query executes fine in ORACLE so I'm not understanding the error ... View more

splunk clean eventdata cleaned the fishbucket and others... Thanks, ... View more

Seems to be a problem with cleaning the fishbucket C:\Program Files\Splunk\bin>splunk clean eventdata -index _fishbucket This action will permanently erase all events from the index '_fishbucket'; it cannot be undone. Are you sure you want to continue [y/n]? y ERROR: Index '_fishbucket' does not exist. ... View more

Many thanks for the additional insight and your expertise it will go a long way in getting me more involved with splunk and its many uses. Happy Thanksgiving to you and yours! Adam, ... View more

Thanks for the post Rich that result is significantly better than my attempts, many thanks! May I ask a follow up or two, I can post individually if that's the preferred method... Why the need to provide a variable ( I assume) for the rex command? I tested the regex and it successfully parsed the record and it also created a new "field". Assuming I wanted to total for all the individual DB's could I add ...| rex database="database [(.*?)]" and somehow group by DB as well? potentially there could be dozens of DB's. Assuming I wanted to see actual user names on a qtrly basis, etc. is that also a possibility? Thanks, ... View more