That worked. I just placed the regex command after the multikv and it omitted the lines I wanted from the search. Thanks! |multikv|regex _raw="^[^(-|\*).*$].*$" Above I remove lines starting with "-" and "*". ... View more

cgilbert_splunk's link should probably work for you too. Something like this: sourcetype=whatever | transaction endswith="Send failed" maxevents=5 ... View more

Wow, that was easy. Thanks for the point in the right direction! ... View more

I'd recommend making a search macro for this. You'd then invoke as: ... | setlocation | ... ... View more

A simple and direct answer for this is to use "Format Visualization". I found this in the Search Tutorial manual (after looking in several other manuals, experimenting unsuccessfully in my case using the log() function with the timechart command; also found only way in Splunk Light Cloud to edit the formatting xml to be in the Dashboard feature, not right in Visualization). Working in Splunk Light Cloud, display results with Visualization tab; in the upper left there are three links - click the Format one: In that dialog, pick the Y-Axis button on the left and change the Scale from Linear to Log: ... View more