This link is a good jumping off point (categorized index/portal for other links that have what you are asking about): https://docs.splunk.com/Documentation/Splunk/latest/Search/Typesofcommands The one that I use this most is this: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions Be sure to check out these files on your Search Head: $SPLUNK_HOME/etc/apps/search/default/commands.conf $SPLUNK_HOME/etc/system/README/commands.conf.spec This is useful, too: https://docs.splunk.com/Splexicon ... View more

That works. ... View more

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work.. | eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid. | eval client_ip="192.162.207.160" - works fine ... View more

Give this a try index=abc_core search_test=* earliest=-7d@h latest=@h | eval date_hour=strftime(_time,"%H") | where date_hour=[| gentimes start=-1 | eval search=strftime(relative_time(now(),"-1h@h"),"%H") | table search ] | eval day=strftime(_time,"%F") | chart count over search_test by day ... View more

Hi | fields -rows -->> "WORKED now i missed a space between - and rows" now the one you gave works as expected" Thanks for your help ... View more

Thanks! This helped. ... View more