I need to look for an incoming email and if an email matches a certain subject, I need to check another source type to see if within an hour of that email coming through there was a hit on that sourcetype. 

Hi All, I am almost a starter in Splunk but my org uses this tool as a log management utility. I need help in getting a direction so as to how to filter data from logs in a distributed a sync logging product. Problem statement: There are multiple log files on multiple Linux boxes getting generated every second. I need to search for ids created and relevant creation timestamps and the batches under which these ids exists. Filter the ids based on passed batches (this is another line in the same log file) Calculate the E2E timestamp for the id processing by searching the processed id in step-1 and substracting the timestamp of step 3 and step 1(this is again printed in the log files). I have been doing this using oracle external tables and Linux shell but need to do it in a better way using Splunk and need help,  opinion's are highly appreciated   

Hi, I have below SPL, which return todays count vs yesterday count and difference between them. I want to see, if i run this search on monday, then the "yesterday" should be last Friday data instead of weekend. could you pls help ? SPL: base search earliest=@d latest=now | append [ base search earliest=-1d@d latest=-1d ] | eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today") | chart count by Name, Day | eval percentage_variance=abs(round(((Yesterday-Today)/Yesterday)*100,2)) | table Name Today Yesterday percentage_variance