Hi @SplunkExplorer, You are right that is Deployment Server log but it should show client ip address too. You can use below search to check deployment steps on client; index=_internal host=YourClientHost sourcetype=splunkd (DeployedApplication OR ApplicationManager OR "Restarting Splunkd") You should see similar events on regarding host logs; INFO DeployedApplication - Checksum mismatch 0 <> 18281318892102154454 for app=your_app_name. Will reload from='x.x.x.x:8089/services/streams/deployment?name=default:your_serverclass_name:your_app_name' INFO DeployedApplication - Downloaded url=x.x.x.x:8089/services/streams/deployment?name=default:your_serverclass_name:your_app_name to file='C:\Program Files\SplunkUniversalForwarder\var\run\your_serverclass_name\your_app_name-1711990721.bundle' sizeKB=xx INFO DeployedApplication - Installing app=your_app_name to='C:\Program Files\SplunkUniversalForwarder\etc\apps\your_app_name' INFO ApplicationManager - Detected app creation:your_app_name WARN DC:DeploymentClient - Restarting Splunkd...    If everything seems ok on these log, we can think the problem is on provided path/filename.   ... View more

Hi @karthi2809, On your screenshots I noticed you are using Verbose mode, and you see events on "Events" tab of search interface not in the query results that shown in "Statistics" tab. I think you need to filter "Response" field values to show only success responses. You can use mvfilter function to filter Response field. I filtered Response values that starts with "PRD". You can update regex inside match to according to your need. Please try adding below eval at the en of your search; | eval Response=mvfilter(match(Response,"^PRD"))   ... View more

You are right, I missed to filter again for exceptions. Please try below, you should see only correlationId exceptions that have no SUCCESS. index="mulesoft" applicationName="s-concur-api" environment=PRD | eventstats values(tracePoint) as TracePoints values(message) as Messages by correlationId | search TracePoints="EXCEPTION" Messages!="*(SUCCESS)*" | fields - TracePoints - Messages | search tracePoint="EXCEPTION" | transaction correlationId | rename timestamp as Timestamp correlationId as CorrelationId tracePoint as TracePoint content.ErrorType as Error content.errorType as errorType content.errorMsg as ErrorMsg content.ErrorMsg as errorMsg | eval ErrorType=if(isnull(Error),"Unknown",Error) | dedup CorrelationId | eval errorType=coalesce(Error,errorType) | eval Errormsg=coalesce(ErrorMsg,errorMsg) | table CorrelationId,Timestamp, applicationName, locationInfo.fileName, locationInfo.lineInFile, errorType, message,Errormsg | sort -Timestamp   ... View more

Hi @raoul, Maybe spaces in your LastLogin field are unprintable characters. Can you try below query which cleans all whitespace? | inputlookup MSOLUsers | where match(onPremisesDistinguishedName, "OU=Users") | where not isnull(LastLogin) | eval LastLogin=replace(LastLogin,"[^A-Za-z0-9,:]+","") | eval LastActive=strptime(LastLogin, "%b%d,%Y,%H:%M") | eval DaysLastActive=round((now() - LastActive) / 86000, 0) | fields Company, Department, DisplayName, LastLogin, LastActive, DaysLastActive ... View more

Hi @verbal_666, You can see related documentation below about timestamp information. The events that missing date_* fields may not have extracted time inside.   https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#Use_default_fields Only events that have timestamp information in them as generated by their respective systems will have date_* fields. If an event has a date_* field, it represents the value of time/date directly from the event itself. If you have specified any timezone conversions or changed the value of the time/date at indexing or input time (for example, by setting the timestamp to be the time at index or input time), these fields will not represent that.   ... View more