Got it.  So limit criteria to 999 conditions. 😉 ... View more

It's also worth noting that if you submit your events to /event endpoint, you skip some pipeline steps completely (most notably event breaking and - by default - timestamp parsing). ... View more

Awesome!  I ended up trying Log Events and created my raw message using _time="$result._time$";calls="$result.calls$";etc and it wrote to the index. so, ya, this is great.  can create a set of X reports that run nightly to add data to this index.  ETL the Splunk way. appreciate the time and education! ... View more

it's a cool concept, but I can't get this to work. imagine the drilldown brings back the individual records for that 15m interval.  the SPL panel supports tokens, of course, but there isn't a way I can use either, it seems - probably my issue. on click i create time_val=$click.value$ in new chart, i see time_val in the url (time_val=1658978100.000) but then when I add $time_val$ as a token (in the dashboard panel) for earliest, i get 'invalid earliest_time' so stuck actually implementing your suggestion. ... View more

i'm all ears on what configs to look at and how to debug! ... View more