for example here's the full data: widgets total item1 10 item2 8 item3 8 item4 8 item5 8 item6 4 and you have a query like |top widgets limit=2. There are is a 4 way tie for the second highest total, but Splunk will only show 2 rows. How does Splunk decide which row to show? What is a best practice to show item1,item2,item3, item4, and item5 (and not item6) in the results? ... View more

I'm currently running this search <data> | timechart span=24h count by day This gives me from midnight to midnight, but I need 10 p.m. to 10 p.m. to capture a 'work day' ... View more