Shouldn't it be ... table **previous_count* ...* ? your search here | stats count | appendcols [| inputlookup threshold | rename count as previous_count | table previous_count ] | eval trigger=if(count>300 AND previous_count<=300, 1, 0) | fields count trigger | outputlookup threshold ... View more

Thanks, man, that's indeed the great answer, which helped me a lot. But what is the max=0 indicates here? Event If there is not any data in the index B, still it shows 1, without max=0 it calculates all of them as 1. ... View more

Check out this post. There are actually several nice workarounds: https://answers.splunk.com/answers/511694/i-have-6-panels-on-a-dashboard-but-can-only-run-3.html ... View more

Actually, I used only search count>0 and it did what I was looking for ... View more

You saved my time, thanks ! ... View more

Actually what I am trying to do is add Instance ID or any TAG from EC2 instance to my apps event. But still I can't find a proper solution how to do that. Using host field is not reliable to match in lookup, because if instance going to be destroyed it's ip and host name release and will be assigned to newly created instance in future. As Instance ID is unique across whole AWS environmet I would like to use that. But in order to do that need add instance id to all events which I am forwarding with splunkforwarder. Instance ID are accessible with the curl command inside current running instance. Any idea on that? ... View more