I have b/w data from multiple switch sourcetype=switch _time | sw | port1 | port2 | port3 | port4 00:01 | sw1 | 10 | 15 | | 00:01 | sw2 | 12 | 17 | 10 | 4 00:11 | sw1 | 7 | 11 | | 00:11 | sw2 | 16 | 30 | 0 | 0 ... and lookup table with service name information about switch and port it running [| inputlookup servicename.csv ] service | cap | switch1 | port1 | switch2 | port2 db1 | 100 | sw1 | 1 | sw2 | 1 db2 | 200 | sw1 | 3 | sw2 | 3 Next I want to run stats to calculate maximum and average use of each port on each service and expect result to be something like this service | switch1 | port1 | Peak1 | Avg1 | switch2 | port2 | Peak2 | Avg2 db1 | sw1 | 1 | 30% | 7% | sw2 | 1 | 0% | 0% db2 | sw1 | 3 | 1% | 5% | sw2 | 3 | 49% | 31% I try to use transpose , subsearch , join or append with stats to match the data together but not found a work query yet. How to get the value from sourcetype=switch to run max and avg on specific field from table and fill in table service name as show above? edit: actual data contain ~80 switch and 300 services. Each switch have port from 20-80 ports. ... View more

This is what I get from universal forwarder : Message=Security Enabled Global Group Member Removed: Member Name: - Member ID: %{S-1-5-21-1659004503-813497703-682003330-1006} Target Account Name: None Target Domain: TEST-4 Target Account ID: %{S-1-5-21-1659004503-813497703-682003330-513} Caller User Name: test Caller Domain: TEST-4 Caller Logon ID: (0x0,0x111E1) Privileges: - This is a same event but see in Event Viewer : Description: Security Enabled Local Group Member Removed: Member Name: - Member ID: TEST-4\temp1 Target Account Name: Administrators Target Domain: Builtin Target Account ID: BUILTIN\Administrators Caller User Name: test Caller Domain: TEST-4 Caller Logon ID: (0x0,0x111E1) Privileges: - You will see that some fields are different e.g. Member ID, Target Account Name,Target Domain,Target Account ID. How can I config splunk forwarder to get the same data as I see in event viewer? Why forwarder change data before send to indexer? ... View more