@stuartidelta01 ahh yes, I had this recently with something else too!  It is in the docs, of course, but easy to miss! https://help.splunk.com/en/splunk-enterprise/leverage-rest-apis/rest-api-reference/9.0/search-endpoints/search-endpoint-descriptions#:~:text=A%20comma%2Dseparated%20list%20of%20actions%20to%20enable.%20For%20example%3A%20rss%2Cemail Basically to enable an action, as you say you need to do actions=<action1>,<action2> not action.<action1>=1 etc 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing   ... View more

If anybody still facing this issues and could not figured out the solution. In my case, I had to change view type.  You can see here there are three options to choose Raw, List, Table. If you want to set JSON syntax highlight by default, you should choose List view.   ... View more

Thanks a lot. It worked for me!! ... View more

Try this: index=myindex action=\*action* | stats min(_time) AS _time range(_time) AS duration BY uniqueId user host | search duration>0 | timechart span=5m dc(uniqueId) AS Sessions avg(duration) as avgDuration ... View more

Try this: index=_internal host=<insert-your-ITSI-host(s)> source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" uri=*SA-ITOA/itoa_interface* |timechart span=1d dc(user) as users ... View more

Lucky guess , I had to go back in my email archives as I recalled I helped a customer with this once. ... View more

Splunk certifications (themselves) through Admin is free. Architect certification costs some. ... View more