Hi all We are watching 44 critical items in Splunk, and we have a search running to let us know if the service is up or down. > index="winevents_server" sourcetype=updown | lookup updownhosts.csv IP OUTPUT Device_name,Use,Model | dedup IP | rename stats as status |table _time,IP Device_name, Model, status > Blockquote how can we alert if any of the values change from up to down or down to up ? i know how to alert on each one, but I did not want 44 searches running at once. is there a way of doing this with one search? ... View more

I am trying to find the amount of time people are on the phone to the help desk but are not getting any results back the input data CSV is below Call_Start_Time,Call_End_Time 31/01/2016 23:32:13,31/01/2016 23:32:19 what i would like to see is a table with call start time and call end time with how long the person was on the phone for the search i have been trying is source="SD_CallData2016.csv" sourcetype="csv" | eval StartTime=strptime(Call_Start_Time,"%Y-%m-%d %H:%M:%S") | eval EndTime=strptime(Call_End_Time,"%Y-%m-%d %H:%M:%S") | eval Duration=strftime(EndTime-StartTime,"%M:%S") | table StartTime EndTime Duration If anyone can help it would be appreciated Thanks Dan ... View more