Thanks @hrawat_splunk  The logs are as expected then 05-03-2024 17:46:52.999 +0000 WARN AutoLoadBalancedConnectionStrategy [24761 TcpOutEloop] - Current dest host connection 1.2.3.4:5678, oneTimeClient=0, _events.size()=993, _refCount=1, _waitingAckQ.size()=0, _supportsACK=0, _lastHBRecvTime=Fri May 3 17:46:48 2024 is using 475826 bytes. Total tcpout queue size is 512000. Warningcount=2001 ... View more

Hi. We just upgraded from 9.0.6 to 9.1.4 and are seeing these same warnings. Do we know that this was fixed in 9.1.4? ... View more

Hi. Have a look at  https://community.splunk.com/t5/Splunk-Search/Why-is-Lookup-definition-in-transforms-conf-not-returning/td-p/589334 Sounds like there's a lookup definition in a transforms.conf and the corresponding lookup file does not exist. You can use btool on the Splunk head to locate the setting. For example /opt/splunk/bin/splunk btool transforms list --debug | grep file   You can see all the lookup file definitions. ... View more

Thanks @isoutamo  ... View more

How about | eval MyNewField=Host+Domain ... View more

Hi.  So you tried | makeresults ns=project* | eval _raw="\"totalTimeTaken\":4" | rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)" | stats avg(response_time)   And there are two problems. 1) the first makeresults .. I don't know what the ns=project* is. Here's the reference https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults 2) your rex is extracting the value into the field Response_Time but then use do stats avg on response_time in lowercase.  Case matters in Splunk field names. Here's what seems to work | makeresults=1 | eval _raw="\"totalTimeTaken\":4" | rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)" | stats avg(Response_Time) ... View more

Hi. Your search is so close to what I do.. change search -> where   | tstats count where index=aws by host | table host | where NOT [| tstats count where index=windows by host | table host] ... View more

Glad to hear this is what you needed.    You can accept this solution to indicate the question was answered to your liking.  thanks! ... View more

Hi so how is are the events being split by Splunk? And do you have any props to tell splunk how to split the events? ... View more

Hi so what's the patching schedule? Every 28 days starting in Feb 1? ... View more

Have a look at Replicate a subset of data to a third-party system You can modify it and do something like this props.conf [your-sourcetype-here] TRANSFORMS-routing = routeAll transforms.conf [routeAll] REGEX=(.) DEST_KEY=_TCP_ROUTING FORMAT=yourIndexer,ThirdParty outputs.conf [tcpout] defaultGroup=nothing [tcpout:yourIndexer] disabled=false server=10.1.12.1:9997 [tcpout:ThirdParty] disabled=false sendCookedData=false server=10.1.12.2:1234   ... View more

Sorry I misread this as wanting a leading space. Ignore my answer. ... View more

Try using printf | makeresults | eval test=printf(" %s","this is a test") | table test ... View more

Hi. Perhaps you can show what your output looks like but basically whatever the final fields are in the search results, those are the fields that can be used in email. What I often do is format up special fields to use in email/slack that are easier for the user to see. For example, I have a search that shows me missing indexers in a cluster manager. My code snippet is | eval cluster_manager=host | stats count by missing_indexer,cluster_manager | eval missing_indexer_cm=missing_indexer + " (" + cluster_manager + ")" | eventstats values(missing_indexer_cm) as missing_indexer_cm   I create a new field missing_indexer_cm which combines 2 fields missing_indexer and cluster_manager So the output is approximately this missing_indexer cluster_manager count missing_indexer_cm --------------- --------------- ----- ------------------- idx1.foo.com cm3.foo.com 42 idx1.foo.com (cm3.foo.com) And then in alerting I use $result.missing_indexer_cm$ but when users click on the results of the search they see the above with all the info   ... View more

Does adding | addinfo help you @Mindy_McTiernan  https://www.splunk.com/en_us/blog/tips-and-tricks/i-cant-make-my-time-range-picker-pick.html   | eval unixtime_Opened_At | eval _time=unixtime_Opened_At | addinfo | timechart ... ... View more

hi. Any fields you want to have reported in the email have to be available in the search results. ... View more

Welcome!  I encourage you to join Splunk's rich user community including Slack https://docs.splunk.com/Documentation/Community/current/community/Chat and one or more Splunk usergroups: usergroups.splunk.com ... View more

Here's the answer https://community.splunk.com/t5/Splunk-Search/how-to-use-a-field-as-timestamp-for-a-timechart/m-p/145037 Use strptime to format your field Opened_At and create a unixtimestamp Then assign that to _time     ... View more

Hi. Can you show what props you are currently using? ... View more