You can definitely send data to Splunk Cloud via API. You will need to configure the HTTP Endpoint Collector: https://docs.splunk.com/Documentation/SplunkCloud/7.2.6/Data/UsetheHTTPEventCollector ... View more

Try append with stats . Also, I'm not sure how this is running without a search command inside the subsearch. sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI earliest=-d@d latest=@d | timechart span=1h count | eval Hour = strftime(_time, "%H") | stats avg(count) as AverageCount by Hour | append [search sourcetype="SysEvents" OR sourcetype="Sysout" TransactionId=TI* AND TransactionId!=TI AND TransactionId!=OPF earliest=@d latest=@h | timechart span=1h count | eval Hour = strftime(_time, "%H") | stats count as TodaysCount by Hour] | stats min(AverageCount) as AverageCount, min(TodaysCount) as TodaysCount by Hour | fillnull value=0 AverageCount TodaysCount ... View more

Do you know what your timezone is set to in your user settings? Splunk stores _time in UNIX time but displays it for you in your timezone. So yes, your hour calculation is going to be based on your timezone. See https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Usedefaultfields#Internal_fields and https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/DateandTimeFunctions#time.28.29 To see how Splunk would convert a UNIX time according to your user settings, try: | makeresults | eval right_now=1559154449, my_hour=strftime(right_now, "%H %Z") Does date_wday look at Friday pacific time or Friday eastern time? date_wday is a default datetime field, which, according to the documentation, are literal values from the event. The datetime values are the literal values parsed from the event when it is indexed, regardless of its timezone. So, a string such as 05:22:21 will be parsed into indexed fields: date_hour::5 date_minute::22 date_second::21. But, if you have a date_wday field, do you have a date_zone field as well? That should tell you what TZ was used for date_wday. https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Usedefaultfields#Default_datetime_fields I'm pretty sure the eval is printing the hour in eastern time Yes, it probably is if you have your TZ set to eastern. This probably won't help unless you want to convert to Pacific. Do i need to change my timechart with something like aligntime=@d-3h? If you're doing an hourly timechart, why not use span=1h@h ? I don't understand having a span of 1 day and then counting by a calculated hour field. If you have date_wday in Pacific time, and Pacific time is how you want to report, have you tried | chart count by date_hour ? ... View more

Try alertMessage=\"?(?<msg>[a-zA-z0-9 ]*) . It works in this example: | makeresults | eval foo="alertMessage=User logged in" | append [| makeresults | eval foo="alertMessage=\"User logged in\""] | rex field=foo "alertMessage=\"?(?<msg>[a-zA-z0-9 ]*)" I just made the first quote optional, and the msg field can only contain alphanumerics or a space, which leaves out the second quote. ... View more