Thanks. I tried that. No change. |time|ESAM:AT_messages:main|ESAM:break_decisioning:main|ESAM:break_evaluation:main|ESAM:break_return:main|ESAM:esam_server_debug:main|ESAM:scte104_splice_request_messages:main|ESAM:vicc_polling:main|ESAM:vicc_sanity_check:main| |2018-06-05|7615438|18|27|16|3029470|11|57495|46| and |sourcetype|date|channel|host|min_time|max_time|count| |ESAM:break_decisioning|2018-06-05|AD2|main|2018-06-05 08:43:50.641|2018-06-05 16:10:24.016|18| |ESAM:break_evaluation|2018-06-05|AD2|main|2018-06-05 08:43:50.294|2018-06-05 16:10:13.902|27| |ESAM:break_return|2018-06-05|AD2|main|2018-06-05 08:52:43.124|2018-06-05 16:12:00.352|16| |ESAM:scte104_splice_request_messages|2018-06-05|AD2|main|2018-06-05 08:51:06.782|2018-06-05 16:10:24.016|11| |ESAM:vicc_polling|2018-06-05|AD2|main|2018-06-05 00:00:02.328|2018-06-05 23:59:59.174|38336| |ESAM:vicc_polling|2018-06-05|TEST|main|2018-06-05 00:00:02.795|2018-06-05 23:59:58.265|19159| |ESAM:vicc_sanity_check|2018-06-05|AD2|main|2018-06-05 12:59:34.020|2018-06-05 13:37:44.024|6| Note the ESAM:AT_messages:main present in the first and missing in the second. ... View more

The other stats calculated are always average, peak & maximum request rates, and sometimes first-seen-time (in day) unique devices count. Peak rate = max of 2 sec moving average request rate or a close approximation (e.g. 98th percentile within minute of per-second request rate, and then max of per-minute 98th percentile for hour & day). I was hoping to avoid making multiple independent passes through the whole dataset, but I can see now that's probably not going to be possible as the count distinct over a different time period will always require a separate pass through the base data. 😞 ... View more

You need to open a support case for enhancement requests.... ... View more

Thanks. I was aware of that deficiency in makecontinuous and trying to avoid it. I can make it work by adding multiple appendpipe s with makecontinuous , one for each device_type, but that needs editing every time that list of device types changes. e.g. | appendpipe [ where device_type=1 | makecontinuous day | where ISNULL(device_type) | eval device_type=1 ] | appendpipe [ where device_type=2 | makecontinuous day | where ISNULL(device_type) | eval device_type=2 ] elc ... ... View more

In practice, the most common reason for this happening seems to be that the .rnd file in your home directory is owned by root rather than your account. Easiest solution: As Splunk user sudo rm ~/.rnd ~/ is equivalent of "the current users home directory" which as @dslife suggested, is also shown in /etc/passwd. grep splunk /etc/passwd The splunk users home directory is typically one of the following: /home/splunk /opt/splunk /opt/splunkforwarder /applications/splunk /applications/splunkforwarder Therefore you could delete the .rnd file like this: rm /home/splunk/.rnd Or you could change ownership of it like this: chown -f splunk. /home/splunk/.rnd ... View more

I added the following, in place of the chart line: | eventstats allnum=false max(uniq_ips) as max_uniq_ips by _time | fields - uniq_ips Now I just need to form an appropriate chart line to create a single value ... ... View more

I agree ... I repeatedly have had to use a cludge to get concurrency ... by ... ... View more

The link is not working anymore and I was not able to find that answer by keywords anymore. Does anyone have a working link, by any chance? ... View more