The subsearch is always preformed first then the results are returned to be used as input to the outer search. https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchTutorial/Useasubsearch So you'll want to do your username search as the subsearch and then the outer will be your check to see if they exist. Something like this: sourcetype="duo:authentication" [sourcetype="sso" ValidateUsernamePasswordAgainstLDAP succeeded earliest=-25m latest=-10m | makemv delim="'" _raw | eval ssouser=mvindex(_raw,1) | fields ssouser ] | dedup ssouser | table ssouser ... View more

These are a bit generic since your SQL is a bit generic but hopefully it will help you get the gist. select count(*) from LOG start from X time till Y time index=LOGindex sourectype=LOGsourcetype earliest=X latest=Y | stats count Fill in the index and/or sourcetype that correspond to your LOG. Fill in the earliest and latest times that correspond to X and Y or use the time picker stats count gets you the count(*) select uniquecount(deviceGUID) from LOG start from X time till Y time index=LOGindex sourectype=LOGsourcetype earliest=X latest=Y | stats dc(deviceGUID) Same as the one above only use stats dc to get a distinct count "SELECT COUNT(DISTINCT e.account) FROM Log e WHERE e.launchPoint IN ?1 AND e.action = 'Tile Selection' AND e.assetId IS NULL AND e.destination LIKE 'page:%' AND e.dateTime BETWEEN ?2 AND ?3" index=Logelocation sourcetype=Logesourcetype launchPoint=1 action="Title Selection" NOT assetId=* destination="*page:*" earliest="12/11/2012:20:00:00" latest="15/11/2012:20:00:00" | stats dc(e.account) index and/or sourcetype for the log as above. Your where criteria goes in the search (before the pipe) Using wildcards can mimic a LIKE search - destination="page:" earliest and latest can be filled in as dates or as relative and then your distcint count ... View more

there is a lot of documentation for visualizations - http://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/Aboutthismanual ... View more

The Independent vs Shared scale options for Trellis toggle between all trellis charts having the SAME Y scale (shared) or for each of them to scale the Y axis based on the information present for that variable (independent). (the XML value charting.layout.splitSeries.allowIndependentYRanges does the same as the toggle in the Trellis options) for example if you're splitting by month and March has a maximum value of 5 and April has a maximum value of 50. Choosing Shared will make both charts' Y-Axis max out around 50. If you choose independent the March chart will max out around 5 and April around 50. In the visualization format you can choose linear vs log but it will change ALL of the trellis charts. I don't believe there is a way to split and have some linear and some log. ... View more

If you change the label rotation it should work. Under Format click the tab for X-axis. Then change your Label Rotation to -90. ... View more

nulls are black instead of being colored. if you can force your zero's to be nulls or maybe only return data that is greater than zero your zeros will become null? ... View more

Try this host="freeswitch" sourcetype="cpu" | eval earliest=info_min_time | eval latest=info_max_time | multikv | timechart span=5m max(cpu_user_percent) as CPU | appendcols [ search host="freeswitch" sourcetype="cdr_xml" | eval Conf_Start=strftime(startTime,"%H:%M:%S %m/%d/%y") | eventstats count(callerName) as Attendees by Conf_Start | timechart span=5m max(Attendees) as Attendees] ... View more