thanks Nick, went with: stats latest(value) as Value by Foo Bar|xyseries Foo Bar Value Its way faster! Plus I dont need to worry about the pesky limits, and it returns both string and numerics. Thanks again! ... View more

Thanks! Will do! ... View more

You probably need a custom condition in your alert i.e. main search ... | stats count(eval(Variability==0)) as not_variable then a custom condition where search not_variable > 0 ... View more

Thanks, I can see a row based estimation on as many fields as I want to report on with stats, but what I really need is the columnar format of chart for example: Product////////Type////////purchase////////sale Apples/////////Macintosh///31//////////////161 Apples/////////Granny//////118/////////////0 Oranges////////Navel///////18//////////////0 If I use stats, I still need to use xyseries as far as I know and this still only allows for a single x value. Right now Im staging out the additional columns into a file via outputlookup and then joining them back in, but thats too complex. Thanks! ... View more

Sorry for the delayed follow-up, I was away for a few days. The strings you are looking for are contained in the messages.pot files in $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/locale. HOWEVER: it is not recommended that you modify this file. It will be overwritten whenever you upgrade, and modifying default Splunk files is not a good practice as a general rule. It can make it difficult for customer support to help you and can have unanticipated effects in your installation. ... View more

Shouldn't REPORT be used instead of TRANSFORMS so search-time extractions are used instead of index-time extractions? ... View more

I actually get it when in the regular flashtimeline search app: [SimpleResultsTable module] [Errno 9] Bad file descriptor It pops up, sometimes goes away on its own, but if I use the paginator or refresh it goes away for a little bit. ... View more