Hello, This is for Splunk Enterprise 7.2.6. I am trying to separate the time presets so that they are divided into columns of my choice. Here is what I want (on the left what I currently have, on the right what I would like to have): According to times.conf, I should be able to do this by assigning values to "order". In this case I am assigning 100, 110, 120, and 130 to the first four, and 800, 810, 820, 830, and 840 to the remaining values. I have noticed, though, that when I change the "latest_time" value for one of the values, then it gets moved to a new column. In my case the "lastest_time" must always be set to "@d". Have I misunderstood something? Is there any way to get my desired result? Thank you and best regards, Andrew
... View more