The syntax of your JS is a little off. I cleaned it up here: require([ "splunkjs/ready!", "splunkjs/mvc/simplexml/ready!" ], function() { function clock() {// We create a new Date object and assign it to a variable called "time". var time = new Date(), hours = time.getHours(), minutes = time.getMinutes(), seconds = time.getSeconds(); document.querySelectorAll('.clock')[0].innerHTML = harold(hours) + ":" + harold(minutes) + ":" + harold(seconds); function harold(standIn) { if (standIn < 10) { standIn = '0' + standIn } return standIn; } } setInterval(clock, 1000); }); After you've fixed your JS, you'll need to use the _bump function to get Splunk to pick up the new JS. So you'll visit http(s)://your.server.here:port/en-US/_bump You can read more about using _bump here: http://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomizationOptions ... View more

I think you're saying you want statistics about tokens - in particular, to know the user ID that used the token the most, the user ID that used the token the least, the action least taken with that token, and maybe the transaction IDs that were associated with the token. If that's right, I think this approach should work for you: a base search that gathers all relevant events | stats values(UserID) AS UserID values(Token) AS Token values(Action) AS Action BY TxnId | eventstats count AS user_count BY Token, UserID | eventstats count AS action_count BY Token, Action | eventstats max(user_count) AS max_user_count min(user_count) AS min_user_count min(action_count) AS min_action_count BY Token | eval max_user_id=if(user_count=max_user_count, UserID, NULL) | eval min_user_id=if(user_count=min_user_count, UserID, NULL) | eval min_action=if(action_count=min_action_count, Action, NULL) | stats values(max_user_id) AS Most_Occurrences_User values(min_user_id) AS Least_Occurrences_User values(min_action) AS Least_Occurrences_Action values(TxnId) AS Transaction_IDs BY Token ... View more

Let's say you write this search so it can query source="qa_data.csv" or source="prod_data.csv" and then you want to use lookup_qa.csv for the first source and lookup_prod.csv for the second. If you have interesting_field in both sources and want to compare them to a field called interesting_lookup_field in your lookup tables, I'd structure my query like this: index=something source="qa_data.csv" OR source="prod_data.csv" | eval qa_lookup_field=if(source="qa_data.csv", interesting_field, NULL) | eval prod_lookup_field=if(source="prod_data.csv", interesting_field, NULL) | lookup lookup_qa.csv lookup_field AS qa_lookup_field OUTPUT something_from_lookup | lookup lookup_prod.csv lookup_field AS prod_lookup_field OUTPUT something_from_lookup | fields - qa_lookup_field prod_lookup_field This separates out the interesting_field into two separate fields so that they are looked up in their respective lookup files. ... View more

The answer above from @kmaron is technically correct, but your search will be more efficient if you move the desired spec into the base of the search. I'd recommend this: index="myindex" AttCnt=* AttNames="*.wav" AttSize=* | stats count by AttNames ... View more

You can use this to get the first character of the file name: | eval file=substr(file,0,1) So insert that directly before your call to | stats count by file and you should get the desired result. ... View more