Hi everyone, I need to know the last activity of the command splunk restart. Is there a way I can find the username of the person correspondingly running the command? ... View more

Hi all, We are having trouble regarding a query in which we need to display multiple metric_labels of a host in a single timechart. the query is as follows: index="xyz" source_host="host1" OR "host2" metric_label="metric_label1" OR "metric_label2" OR "metric_label3 " OR "metric_label4" |dedup source_host _time | append [ search index="abc" source="source.csv" ] | timechart span=12h count(metric_value) as metric_value count(number) as "No of tickets" We need to pull the result of two searches in a single timechart. Urgently required inputs from you guys. Thanks a lot! ... View more