I have a log that that has multiple utc times listed. The logs are ingested into Splunk and I have created a field extraction to show those times in my Splunk table query. Now I am trying to populate the ProcessingTime with the difference between two of the fields. I'm missing something. Can't get the ProcessingTime to populate. Any help would be great. Query: host=clbflncolp11 index=_* OR index=* sourcetype=ibm:was:icc source="D:\\IBM_ICC_AuditLogs\\ibm.ctms.taskrouting.auditlog-SalesActiveIngestion*.log" | eval ProcessingTime=file_modified-file_created | table ProcessingTime, file_modified, file_created, corp_copy_dt Sample Result: ProcessingTime file_modified file_created corp_copy_dt     +2021-04-19T18:15:19:564+00:00-UTC +2021-04-19T18:15:19:299+00:00-UTC +2021-04-19T15:15:19:000+00:00-UTC     +2021-04-19T18:15:18:955+00:00-UTC +2021-04-19T18:15:18:689+00:00-UTC +2021-04-19T15:15:19:000+00:00-UTC     +2021-04-19T18:15:20:470+00:00-UTC +2021-04-19T18:15:19:924+00:00-UTC +2021-04-19T15:15:20:000+00:00-UTC     +2021-04-19T18:15:21:205+00:00-UTC +2021-04-19T18:15:20:861+00:00-UTC +2021-04-19T15:15:21:000+00:00-UTC             ... View more

Hi, I am very new to Splunk reporting and I am trying to change a timechart I have to show in GB since we are using a 4TB disk share. Below is my search query. It comes up OK, but just trying to make it more friendly. index=perfmon host=ServerName eventtype=perfmon_windows NetShare14| timechart span=24h avg(Free_Megabytes) as MB_Free Thanks Kesrich ... View more