The easiest way is to move the total details to the header (field names) like I show here: https://answers.splunk.com/answers/779523/how-to-append-column-total-to-column-name.html#answer-778742 Then you don't need the last "Total" row and remove it so that there is nothing on which to click! ... View more

Avoiding join is good. Using All Time is bad. Are you sure it's necessary? Your comment well explains why you chose the approach you did, but it's still not clear what the end goal is. What is to be learned from the final results? ... View more

@vkrishnachand, From your requirement, you have a common field in both sourcetypes and want to get the events from sourcetype A if there is a matching value in sourcetype B. Assuming the field name as ID try with stats and lets know what's missing index=test (sourcetype=A OR sourcetype=B) |stats values(sourcetypeA_filed1 ) as sourcetypeA_filed1 , ............ values(sourcetypeA_filedn ) as sourcetypeA_filedn ,dc(sourcetype) as c by ID|where c>1 ... View more

hey @vkrishnachand Try this The easiest method is to bump the server. https://<yourSplunk>/en-US/_bump Click that button. Every click increases the bump, which effectively breaks all caching in the webserver. No need to restart! If you find it doesn't work as expected, run also the debug/refresh endpoint. https://<yourSplunk>/debug/refresh And if that doesn't work, restart the web service only. $SPLUNK_HOME/bin/splunk restart splunkweb And if that doesn't work, restart Splunk. Let me know if this helps you! ... View more

There are many problems with join and it does not scale. Use a solution like mine. ... View more

That search should do it. You can rearrange the fields like this if you want: | fields A G C D F (don't forget we made G the value of B or E) ... View more