Wanted to share some good news regarding this issue with the broader community - over the past year we worked with Splunk and Microsoft support and development teams to sort this out. In our organization, 99% of the corrupt events were when Windows was rebooting - a fix for this was identified and successfully tested in our environment. Remaining issue was related to an api error response from EventLog api and a fix for that is in the works per Splunk Dev and support. Both fixes are expected to make it into 9.1 (hopefully around .CONF23). And here's some recommendations that came from the collaborative work with Microsoft. Use 'Delayed Start' for the Splunk Forwarder service. Setup following service dependencies to reduce errors sc config EventLog depend=RpcSs sc config SplunkForwarder depend=EventLog ... View more

See if you can avoid join by getting LPN1 and LPN2 and coalescing them.  Then do a stats to get the values needed. source="C:\\Logs\\*" host="myHost" index="dumpchutes" ("TELEGRAMID=[42]" "LastDestination=[51]") OR ("TELEGRAMID=[CONTAINERSTATUS]" "ContainerState=[DIVERTED]" "Divert=[PALLETIZE]" "ReasonCode=[DS]") | rex "OriginalDestination=\[(?<OriginalDestination>[^\]]+)" | rex "OriginalDestinationState=\[(?<OriginalDestinationState>[^\]]+)" | rex "EntrancePoint=\[(?<EntrancePoint>[^\]]+)" | rex "EntranceState=\[(?<EntranceState>[^\]]+)" | rex "ExitPoint=\[(?<Chute>[^\]]+)" | rex "ExitState=\[(?<ExitState>[^\]]+)" | rex "BarcodeScannerId=\[(?<BarcodeScanner>[^\]]+)" | rex "BarcodeScannerDataState=\[(?<BarcodeScannerDataState>[^\]]+)" | rex "BarcodeScannerData=\[(?<LPN1>[^\]]+)" | rex "Length=\[(?<Length>[^\]]+)" | rex "Width=\[(?<Width>[^\]]+)" | rex "Height=\[(?<Height>[^\]]+)" | rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" | rex "PalletId=\[(?<ChuteHolder>[^\]]+)" | rex "LpnNumber=\[(?<LPN2>[^\]]+)" | rex "WcsLocation=\[(?<WcsLocation>[^\]]+)" | rex "LocationBarcode=\[(?<LocationBarcode>[^\]]+)" | eval LPN=coalesce(LPN1,LPN2) | stats values(*) as * by LPN ... View more

I was looking for a solution to similar problem and came across your post. See example here to do the coloring - https://answers.splunk.com/answers/820403/how-to-change-font-color-based-on-a-condition-for.html. Then use fields option in simple xml to show only the columns you want. Have fun! ... View more