Hi smudge797, you need to to escape the < and > in the XML using &lt; and &gt; or the <![CDATA[ tag, fine more details in the docs http://docs.splunk.com/Documentation/Splunk/6.4.3/AdvancedDev/AdvancedIntro#Special_characters_in_XML_files Hope this helps ... cheers, MuS ... View more

Hi dbcase, look at this answer https://answers.splunk.com/answers/196554/timechart-fill-values-in-empty-slots.html where you can find an example an another link to another answer. Hope this helps ... cheers, MuS UPDATE: Try this run everywhere search: index=_internal | eval hasSource=if(searchmatch("source"),1,0) | stats count as myCount sum(hasSource) AS hasSource by _time | bin _time span=1min | chart sum(hasSource) AS count over _time it will check the events for the field called source and counts them, the bin sets the _time to the span value and the chart will display it like timechart ( timechart is nothing else but a chart ... over _time by ... ) UPDATE OF UPDATE: The final working search was this: host="ccivirpxa0*" index=cox sourcetype=wls_managedserver | eval isEvent=if(searchmatch("STUCK"),1,0) | stats count as myCount sum(isEvent) AS isEvent | eval result=if(isEvent>0, isEvent, myCount) | table result ... View more

Hi BradL, No, since a sub search is run before the main search there is no way for a sub search to get information back from a main search. Maybe you should look at this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to get an idea how it can be done without sub search and its limits or the March session of 2016 virtual .conf here http://wiki.splunk.com/Virtual_.conf cheers, MuS ... View more