This fixed my issue. Thank you very much. I do have one suggestion: The path to perpanelfiltering is /opt/splunk/etc/slave-apps/SA-Utils/appserver/controllers/perpanelfiltering.py Also, an edit to SOLNLookupEditor was all the changes that were required for me. perpanelfiltering did not need any adjustment. ... View more

At the first line of your sql query, you might not need to convert the time to vchar. Splunk might not able to identify the time format by using vchar. ... View more