Hello @woodcock  A question, in your post I see that you talk about some scripts, I wanted to know if those allow you to stop the error=3 when you run a search and it doesn't return any results Currently I need to run correlations search with the command at the end "... | sendalert risk ... " But when there are no results it throws that error and the whole correlation search is truncated, and for that reason I wanted to know if there is a way to abort the sendalert risk when there are no results  ... View more

I normally prefer to write "only do this if this condition is met", so I know the condition/scenario of the search and helps in troubleshooting. ... View more

You don't need replaytimestamp (that feature should probably be removed, but it's being used by one consumer right now). Replaytimestamp is when you want to take a group of transactions using bundlelines and then randomize the time between them. It's specifically targeted at use cases where you want to run the Splunk transaction command and have a varied duration. This may be a bug. Can you try with the Dev branch from https://github.com/splunk/eventgen and see if you're seeing that there? This branch is about to become master after a few years of development, and I'd like to see if you can reproduce it there. I'm relatively certain it should work properly on that branch. ... View more