I want to create a scheduled search that will track the changes made in content under Splunk Enterprise security app. If someone modifies correlation searches i want my query to capture it. Can this be achieved?? Please help.   ... View more

Hi All, I am trying to create a drilldown for my timechart, the idea is to drill down to the events that happened 30 mins before and after the clicked time (click.value in my case). I referred the answer https://answers.splunk.com/answers/215176/subtracting-30-minutes-from-passed-drilldown-param.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev Now this is helping me pass the earliest time, but when i use the same concept with the latest time i am not getting the desired result. Below is my current query: index="tutorial" categoryId=strategy earliest=[|gentimes start=-1|eval new = relative_time($click.value$,"-1800")| return $$new] latest=[|gentimes start=-1|eval latest1 =($click.value$ + 1800)| return $$latest1] | top clientip after passing through the drilldown pipeline the query changes to: index="tutorial" categoryId=strategy earliest=[|gentimes start=-1|eval new = relative_time(1572728400.000,"-1800")| return $new] latest=[|gentimes start=-1|eval latest1 =(1572728400.000 1800)| return $latest1] | top clientip If you look closely the + sign just vanished. I tried many ways to find a work around for that but wasn't able to. Please take a look and try to run the query once by yourself. @Raghav2384 @RVDowning @somesoni2 @woodcock @gcusello @mayurr98 please help guys!! ... View more