MAX_TIMESTAMP_LOOKAHEAD gives the last char position before which the timestamp have to be found, not it's starting point. ... View more

http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch#Specify_relative_time_ranges_in_your_search Maybe: ((index=larger_general_index earliest=-5m) OR (index=categorized_rare_events latest=-5m)) interesting terms ... View more

i can't tell if the question is the result of him having a field called "count" as you think, or whether he just wants the "count" field to be the first field. "top" returns fields as " , count, percent" ... View more

Just checked the resultset now and it works a treat ... View more