2020-12-17T01:21:44.690341+00:00 txn1.test-fdb-us-south-004 2020-12-17T01:21:44Z { "Severity": "10", "Time": "1608168104.425364", "Type": "MachineMetrics", "ID": "0000000000000000", "Elapsed": "5.00001", "MbpsSent": "2.59981", "MbpsReceived": "2.3487", "OutSegs": "12262", "RetransSegs": "0", "CPUSeconds": "0.111557", "TotalMemory": "67510792192", "CommittedMemory": "4303114240", "AvailableMemory": "63207677952", "ZoneID": "txn1", "MachineID": "txn1", "Machine": "10.95.111.226:4503", "LogGroup": "default", "Roles": "RV", "TrackLatestType": "Original" }     I came  up with : index=fdb sourcetype=* |eval (rex "^s(?<severity>[.]*)y$") as sev | stats  count(eval(sev “40”)) as ERROR count(eval(sev “20”)) as WARN count(eval(sev “10")) as INFO  by sourcetype       it doest work...     I want to. create a table or time chart. to  list all he severity according to sourcetype.   ... View more

2020-11-30T23:59:46.101621+00:00 fdb2.fdb-us-south-002 2020-11-30T23:59:45Z { "Severity": "10", "Time": "1606780785.516014", "Type": "SomewhatSlowRunLoopTop", "ID": "0000000000000000", "Elapsed":"0.0734675", "Machine": "10.185.175.43:4501", "LogGroup": "default" }   I want to how Can i extract "severity": "10"  & Machine ip  in the search from the logs  and put. it in a table format. ... View more

How to create a search from raw logs " I want to extract a srtring in the format " severity" = "40." from raw logs ... View more

I want to create a dashboard on severity level , and hardware its causing on, what will be the base search lookalike ? ... View more

Can i get index daily usage for a. particular index? ... View more

how to check the daily data usage in a particular index and also historical daily data in gb   and more information about the capacity in buckets. ... View more

HI. --How to check ip address of indexers from search head ... View more

NOT "/healthCheck" , what the point of using this n search ? I want to know is it searching for string health check in logs ? there is no filed like healthcheck in Splunk . ... View more

why does some of the fields in the SH starts with # , and others not . ... View more