I'm having the same issue here. Did you manage to solve it? ... View more

Hi SAPrabhakar, I don't know why Splunk has this behavior that I found many times, maybe it's a Splunk bug and I opened a case to Support some months ago. Every way, you can use a workaround (or better a "porkaround"!) inserting in your base search an eval command with fields you have to use in the panel's search, in your example: index=ssi_app_index TATL message.facets.url=*ValidateClaim* message.facets.url=https://me.myself.com* | eval message.facets.duration=message.facets.duration If you have more fields you have to add each one in the same way. Bye. Giuseppe ... View more

You can try timechart with span=1h for hourly bins which are filled with 0 by default: <Your Base Search> | timechart span=1h count(eval(user="admin")) as LoginSuccess ... View more

top gives you the top occurrences of a field value. So if your duration field had "1" as a value more times than values of "100000", "1" would be the top entry. Probably not what you wanted! 🙂 ... View more

Try this To convert to epoch your base search | eval testTime = strptime('message.facets.requestStart', "%m/%d/%Y %H:%M:%S:%N") To convert to epoch and round to start of the day your base search | eval testTime = relative_time(strptime('message.facets.requestStart', "%m/%d/%Y %H:%M:%S:%N"),"@d") ... View more