Add the inputlookup command to your saved search to dedup before you output. Run it without the outputlookup command first for testing purposes. index="linuxevents" AND host=rub.us AND source="/var/log/audit/audit.log" AND acct="$userId_tok$" | stats count as _count by acct, auid, addr | rename acct AS ACCT, auid AS AUID, addr AS ADDR | inputlookup myAAAlookup.csv append=true | dedup ACCT AUID ADDR | outputlookup myAAAlookup.csv append=true ... View more

as @renjith.nair stated in the comments, I believe what you're after is simply index="search_index" search processing_service | eval time_in_mins=('metric_value')/60 | stats avg(time_in_mins) as all_channel_avg which would just output one column named all_channel_avg and one row with the avg. if you'd like both the individual channel avg AND the total avg, possibly something like: index="search_index" search processing_service | eval time_in_mins=('metric_value')/60 |eventstats avg(time_in_mins) as total_avg| stats values(total_avg) as all_channel_avg avg(time_in_mins) as channel_avg by channel however, you might want to do a count and sum in the stats command and then the eventstats and some eval in order to not run eventstats before stats. index="search_index" search processing_service | eval time_in_mins=('metric_value')/60| stats avg(time_in_mins) as channel_avg sum(time_in_mins) as total_mins count as total_count by channel|eventstats sum(total_mins) as total_mins sum(total_count) as total_count|eval all_channel_avg=total_mins/total_count again, that might actually need some work, as i'm currently really thinking that the math might not be right.... ... View more

if you do a <base search>|stats count by latency|sort 0 - latency , is the first result the same? try doing index=fultonrssi sourcetype=FultonRSSI test_type_code=PING closet_id="*" host=*| timechart max(latency) as "Max Latency" by site_name or index=fultonrssi sourcetype=FultonRSSI test_type_code=PING closet_id="*" host=*| chart count by latency site_name to check the differences. Those searches you have look accurate to me, so in my opinion, it looks like those sites have the same max for that time frame. You could try to add span=5min to the timechart to see if a more narrow span will yield different results, as well. ... View more

This isn't going to necessarily highlight the entire row, but you can highlight the cell that you care about based on the value. In the dashboard, click on the pencil the top right of the column, enable color based on values and enter the values/color that you're interested in highlighting. Another way to go about highlighting those rows is by using JS and CSS. You can use this answer for reference: https://answers.splunk.com/answers/588394/change-the-color-of-rows-in-a-table-based-on-text-1.html ... View more

can you try something like this? if i'm understanding what you're looking for, you just need to add in EventCode to your fields and stats commands. index=wineventlog | fields _raw EventCode | eval esize=len(_raw) | stats count as count avg(esize) as avg by EventCode | eval bytes=count*avg | eval kb=bytes/1024 | eval mb=round(kb/1024,2) | stats values(kb) as KB, values(mb) AS MB by EventCode ... View more