1) I found out how to filter events based on _time and put a delete command. Please let me know if this is a correct approach index=summary report=report=group_ip | eval epoch1 = _time | search epoch1="[number]" | delete 2)   The command above didn't work because I don't have permission to delete.        I went to "[Settings > Users > your_user]",  I was unable to find "Users" Please suggest. Thanks 

hi @LearningGuy, 1) sorry there was a mistyping ! I wanted to say that the can_delete role isn't usually enabled on production systems, so you have to enable it for your user and disable after deleting, dor leave it associated to your role! 2) you generated many events  with your scheduled search: someone to dlete and someother to maintain (I suppose). so, be sure (testing your search) that the results of your search will be only the events to delete then you can run the delete command after your search. can_delete is a stadard Splunk role, that you should be able to associate to your user in [Settings > Users > your_user]. Ciao. Giuseppe

Thanks   yes the search looks strange, but it's the only way out of my problems. If dest_interface=outside the cable to outside interface is connected.  Not sure why, but it's perfect. I have also tried to use appendcols to combine both graphs without success.  I think I must do more investigation to find out why. Geir

Hi @gcusello, I have not tried delete command   1) Could you please explain what you meant by this command you said previously and provide an example?  "ta the rend disable the can_delete role" 2) How do create a search to identify the event?  I tried to filter the event generated on a specific hour  based on "_time" field, but it didn't give me result.  3) How do I know if I have can_delete role?   How do I enable it? Thank you so much for your help

Hello.   Not sure if you figured out this issue yet. What I found was that a recent Splunk update moved some js libraries into the quarantined folder due to incompatibility with jQuery 3.5. So far I haven't seen any other solutions. We actually moved the js and css files into our APPLICATIONS with modifications to the js to adhere to jQuery 3.5.