Nice example @dtburrows3 ! You can always get more than the 1500 in the example with stats values to avoid the stats list limit of 100 and prefix the rand with the row index #, e.g. start the search with | makeresults count=1500 | streamstats c | eval low=1, high=100, rand=printf("%05d:%d", c, round(((random()%'high')/'high')*('high'-'low')+'low')) | stats values(rand) as nums | eval cnt=0 | rex field=nums max_match=0 "(?<x>[^:]*):(?<nums>\d+)" | fields - x c ...  

You can try putting a makeresults command at the start of your third search an it may work. Assuming the the tokens $Denominator$ and $Numerator$ both populate as expected then running this SPL on your dashboard should do it.   | makeresults | eval result=round((tonumber("$Numerator$")/tonumber("$Denominator$"))*100)."%" | fields - _time    POC on local instance:    

Hi @yvan-rostand  As per my understanding, you should use props and transform.conf as well.   Maybe could you pls try this idea - forward data to 3rd party systems: https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Forwarddatatothird-partysystemsd  

Oddly, even the Call Record Monitoring is not an option under the Teams menu, when in the Microsoft 365 App for Splunk. The only options are:  Teams Activity Overview Teams Security Monitoring Teams Activity Report Teams Activity Audit

This is a really neat problem! Does doing something like this get you where you are trying to go?       | makeresults | fields - _time | eval nums="1,2,3,4,5,6,7,8,9,10" | makemv nums delim="," | eval cnt=0 | foreach mode=multivalue nums [ | eval moving_window_size=3, summation_json=if( mvcount(mvindex(nums,cnt,cnt+('moving_window_size'-1)))=='moving_window_size', mvappend( 'summation_json', json_object( "set", mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)), "sum", sum(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1))) ) ), 'summation_json' ), cnt='cnt'+1 ]       End result looks something like this:   I'm sure this can be standardized more and not sure how you want the final results to be formatted but you should be able to parse out the final MV json objects to get what you need out of them. Update: With the addition of the field "moving_window_size" it is a bit more standardized. And here it is in a slightly different format (summations associated with their own fields):   | makeresults | fields - _time | eval nums="1,2,3,4,5,6,7,8,9,10" | makemv nums delim="," | eval cnt=0 | foreach mode=multivalue nums [ | eval moving_window_size=3, iter_count="iteration_".'cnt', summation_json=if( mvcount(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)))=='moving_window_size', if( isnull(summation_json), json_object('iter_count', sum(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)))), json_set(summation_json, 'iter_count', sum(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)))) ), 'summation_json' ), cnt='cnt'+1 ] | fromjson summation_json | fields - summation_json, iter_count, cnt | fields + nums, iteration_*     And this SPL to try and simulate your original use-case (also added some addition context in the output): | makeresults count=1500 | eval low=1, high=100, rand=round(((random()%'high')/'high')*('high'-'low')+'low') | stats list(rand) as nums | eval cnt=0 | foreach mode=multivalue nums [ | eval moving_window_size=5, summation_json=if( mvcount(mvindex(nums,cnt,cnt+('moving_window_size'-1)))=='moving_window_size', mvappend( 'summation_json', json_object( "set", mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)), "sum", sum(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1))), "average", sum(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1)))/'moving_window_size', "min", min(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1))), "max", max(mvindex('nums', 'cnt', 'cnt'+('moving_window_size'-1))) ) ), 'summation_json' ), cnt='cnt'+1 ] | eval average_sum=sum(mvmap(summation_json, tonumber(spath(summation_json, "sum"))))/mvcount(summation_json), min_sum=min(mvmap(summation_json, tonumber(spath(summation_json, "sum")))), max_sum=max(mvmap(summation_json, tonumber(spath(summation_json, "sum")))) You can see by the screenshot below that I hit some Splunk limits when trying to put together a MV field with 1,500 entries (truncates to 250). But other than that it seems to work.  

Just want to pop in and let you know that I think this SPL you shared is not actually capturing the minutes>55 but including the minutes between 0 and 9 just because of the way that Splunk buckets time windows. You should be able to see this demonstrated with this SPL <base_search> | eval true_minute=strftime(_time, "%M"), true_hour=strftime(_time, "%H") | bin span=10m _time | eval bucketed_minute=strftime(_time,"%M"), bucketed_hour=strftime(_time, "%H") | where 'bucketed_minute'>54 OR 'bucketed_minute'<6 | dedup true_minute  Results I'm seeing look something like this. To stay in the spirit of the simpler SPL and to build on your methodology, I think something like this would do the trick. Here is sample code as a POC of the minutes being bucketed properly. <base_search> | where tonumber(strftime(_time, "%M"))<=5 OR tonumber(strftime(_time, "%M"))>=55 | eval date_minute=strftime(_time, "%M"), date_hour=strftime(_time, "%H"), original_time=strftime(_time, "%Y-%m-%d %H:%M:%S"), snap_time=case( 'date_minute'>=55, strftime(relative_time(_time, "@h+1h"), "%Y-%m-%d %H:%M:%S"), 'date_minute'<=5, strftime(relative_time(_time, "@h"), "%Y-%m-%d %H:%M:%S") ) | fields - _time | fields + original_time, snap_time, date_hour, date_minute   And to use this method with your original ask it would look something like this. <base_search> | where tonumber(strftime(_time, "%M"))<=5 OR tonumber(strftime(_time, "%M"))>=55 | eval date_minute=strftime(_time, "%M"), date_hour=strftime(_time, "%H"), _time=case( 'date_minute'>=55, relative_time(_time, "@h+1h"), 'date_minute'<=5, relative_time(_time, "@h") ) | stats count as count by _time  Examples:     Both 07:57 AM and 08:04 would fall into the 8:00 AM bucket in the stats count by.

Looking at the conf files and navigation for app https://splunkbase.splunk.com/app/3786 It looks like the "Teams Call QoS" dashboard should be located at. From the App navigation menu:     Teams ==> Call Record Monitoring ==> Teams Call QoS There is also a file in <app>/default/data/ui/views/teams_call_qos.xml on the most recent version I just looked at. so not really sure why it wouldn't be available