I was trying to get report of top notable events created in splunk. Below is the search query for it: | es_notable_events | search timeDiff_type=current | stats sparkline(sum(count),30m) as sparkline,sum(count) as count by rule_name | sort 100 - count I need to know what is timeDiff_type=current means? If I put timeDiff_type=* , I am getting huge increase in count of data. Different question related to same 'es_notable_events' : The output for the query that I am putting is fixed. If I am changing the time-picker to past 1 week, Iam getting the same data. Same output is shown If I change the timings. Why the data is not changing ? ... View more