Assuming you always want to use detected_timetamp and never what is now _time, I'd recommend changing the timestamp extraction for that sourcetype. See https://docs.splunk.com/Documentation/Splunk/7.2.6/Data/Configuretimestamprecognition for how, and open new questions with any issues you might have. If you want to do this in some search without changing the data getting indexed because most of the time what is now _time is the right time and only this time you want detected_timestamp, you can do something like this: ... | eval _time = strptime(detected_timestamp, "%F %T.%N") | eval date_hour = ... XOR ... | eval date_hour ... | eval date_wday = ... | search ... | eval _time = strptime(detected_timestamp, "%F %T.%N") | timechart count depending on whether the date_hour/date_wday filters you have right now should be applied to _time or detected_timestamp. ... View more

You'll want lists looking like this: computer,type U-0050,Linux Then you can search like this: | inputlookup a.csv | inputlookup append=t b.csv | stats values(type) as types by computer | search NOT types="Linux" If you can't change your lists you can turn them into this too: | inputlookup LINUX.csv | eval type="Linux" | append [| inputlookup DEFENDER.csv | eval type="Defender"] | eval computer = coalesce('Linux Computer', 'All Computer') | stats ... ... View more

It's normal behavior for the UI to display yyyy-mm-dd 00:00:00 (00:29:xy bin'd to 30m) as just yyyy-mm-dd. Same behavior can be observed about not displaying 000 milliseconds, it's trying to simplify the timestamp for you. ... View more

Your initial stats triggers a massive on-disk search, exhausting the user's dispatch space. On slack you mentioned you have a tiny duplication issue which made you add that first stats - it's probably not really relevant to your overall results. Try this: index=redacted | stats dc(CorrelationId) as count, avg(time_taken) as AvgTime, p99(time_taken) as p99, p95(time_taken) as p95, p90(time_taken) as p90, p50(time_taken) as p50 | foreach AvgTime p* [eval <<FIELD>> = <<FIELD>> * 1000] Note that I've moved the eval to after the stats, then you don't have to do millions of evals for each single event. ... View more