Yes that is it. Worked for me to. ... View more

This worked for me on 4.2.5. Thanks. ... View more

This is what i use: index=_internal metrics kb series!=_* group="per_index_thruput"| eval indexed_GB = (kb / 1024 / 1024)  | timechart eval(round((sum(indexed_GB)),2)) as TotalGB fixedrange=t span=1d You can also schedule the search and put the result in a summary index, so you can make fast searches over a longer time period. ... View more

What you have is a multivalue field. To get to the values use the mvindex command. mvindex(multifield, 2) First check if a field is multivalued: mvcount(multifield) To get to the values In your case: | eval name=mvindex(yourmultifield,0) | eval surname=mvindex(yourmultifield,1) | ... You can also split a field to get a multivalued field. split(foo, ";") http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions ... View more

Just copy or link savedsearches.conf from your app to the /mobile/default directory. It worked for me. ... View more