Hiya, It seems that since upgrading splunk to v5, any searches which are grouped by a count. e.g.: “test” | stats count by host Do NOT show the flashtimeline at the top of the search results. The flashtimeline DID show on the same queries before our upgrade. If I remove the count by. E.g. above just search for. e.g.: “test” ...the flashtimeline does display. Any advice would be appreciated. ... View more

Hi there, I have a query whereby I wish to return results over the previous week, but NOT within a specific couple of hours every day. At the moment it looks something like this: source="*prod-*.log" earliest=-7d@w0 latest=@w7 | where NOT (date_hour>=9 AND date_hour<=11) | stats count by eventtype However it is not excluding those events which fall between 9 and 11 each day. If possible, I'd also like to know how to also specify the minutes in the query. e.g. source="*prod-*.log" earliest=-7d@w0 latest=@w7 | where NOT (time>=9:58 AND time<=10:15) | stats count by eventtype Please note, I've invented the "time" keyword above to demonstrate what I'm after. Any help would be appreciated. Cheers, Ben ... View more

I'm running a query at the moment which categorizes log lines by eventtype. Is it possible to have the timeline which displays on the search window, display in a dashboard? ... View more