I have two indexes having status of Batch jobs that run in our system daily.  Source 1:  Contains JobName, StartTime, EndTime, Status. The job status can be - Active, Completed, Failed. The source or the log name itself is the jobname here. A new event will be created each time the Status changes in the same source. This source contains the up to date information for all jobs except those that are bypassed. Source 2: This is a DB source containing these fields - JobName, BypassFlag, AvgRunTime. This source contains AvgRunTime of all jobs, BypassFlag which tells if a job was bypassed today.  Need: I am trying to get each JobName(Source1 and Source2), StartTime(Source1), EndTime(Source1),  JobStatus(Source1), if the job was bypassed today(Source2),AvgRunTime of job.   Query I tried using Outer join: I tried using both indexes in same query and also joins but with outer join i am getting results only from the first index even though I am doing an outer join. Please help. (index="index2" sourcetype=db) | table JobName,BypassFlag,AvgRunTime | join type=outer JobName [search index="index1" host=tnsm123* | stats latest(JobName), latest(Status), latest(StartTime),latest(EndTime) by source | table JobName, Status, StartTime, EndTime by source] | table, StartTime, EndTime, Status, AvgRunTime, BypassFlag   ... View more

Data in an event: The data contains total processes that can run, number of processes running, userID with which they are running, the pool under which they are running, names of each of them running on a server at a particular time. All processes will run from this directory - /root/user/bin/. They either end with .sh or .deb. Single Event: Time: 21:30 Total: 60 Running: 05 mt100 pool1 /root/user/bin/process1.sh mt100 pool12 /root/user/bin/process21.deb mt201 pool2 /root/user/bin/process321.sh mt301 pool3 /root/user/bin/process432.deb mt301 pool312 /root/user/bin/process52.sh Question: How do i extract only the list of process names into a multi value field. I was not able to achieve this through field extraction using regex as it was extracting everything. I tried using rex field option in splunk search, but it wasn't sure where to start since there were multiple values. Any help is greatly appreciated. Thank you I am trying the get the below values in a single field for the above event: /root/user/bin/process1.sh /root/user/bin/process21.deb /root/user/bin/process321.sh /root/user/bin/process432.deb /root/user/bin/process52.sh ... View more