We have got some support of Splunk, and the problem was in the SA-indexCreation  app at the indexer. The wrong version was installed, where there was no support for metric collection.  Now we have installed the correct version, and everything works fine.  ... View more

You would be able to combine this if they have a common field that can correlate them. From the example/screenshot, only common field I can see is _time, so my answer is based on _time, change the field if there are any other common fields. Update Actually BSN is the common field, so updating it to BSN index=security-mijnssp "View rendered = /error.jspx" OR "Er is een fout opgetreden op de JSF pagina" | rex "BSN=(?P<BSN>[^<]+) View" | rex "INFO n.s.m.w.l(?P<INFO>[^<]+)"|rex "ERROR n.s.m.w.l(?P<ERROR>[^<]+)"| table INFO,BSN, ERROR, _time |stats values(*) as * by BSN ... View more