Hello Vincenteous, This is happening because of your old sendemail.py file. If you have managed to customize it you may not be able to use it with savedsearch. There are two options. One is to include a |sendmail command in your search and remove the to list. This will just work fine with all the provided parameters to the command. You need to replace the sendemail.py file with default search app sendemail.py file and customize it. You may also go for a scripting solution which will not actually change with every splunk release. Splunk doesn't give us a good template to customize our own email format so we need to do it by ourselves. Thanks, L ... View more

Hello, Don't include the time any where while doing the summary. When you start aggregating data the search automatically becomes faster.We all know collect command will populate all the value but it has limitation where it take the local machine's name rather than the actual host. So do something like this. Have some sample timing to have granularity of the summary index=iis|bucket _time span=30m| stats count dc(cs_username) by cs_username Create a saved search and schedule it for a one time load to the target summary index. define the earliest and latest parameter according to your requirement. Avoid running it again and again to have duplicate entries. with the above you can preserve internal event timing and you can use the time range picker because in the summary data you have the time trend. in your Dashboard do the calculation. You should be fine now by user selecting time ranges Thanks, L ... View more

Hello Ajay, You need to control these things in the search query where you get the result. If they are already extracted records. Search name!="john"|chart... OR Search ...|where name!="john"|chart... Thanks, L ... View more

More over did you check if the perfmon counter are available in your system? SOmetimes they get corrupt and are not accessible ... View more