Hi @schiwark, did you tried something like this? your_search earliest=-10m@m latest=now | stats values(fieldB) AS fieldB count BY fieldA | where count>10 Ciao. Giuseppe ... View more

Hi here is instructions for update order if/when you have distributed environment. https://community.splunk.com/t5/Installation/What-s-the-order-of-operations-for-upgrading-Splunk-Enterprise/td-p/408003 r. Ismo ... View more

Hi @schiwark , using the addon will also require some settings on Service Now to integrate with Splunk, as this option provides not only creating/updating incidents but you will be able to get incident data from Service Now in Splunk. You can refer below link for the details on set up required on Service Now side. https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/ConfigureServiceNowtointegratewithSplunkEnterprise For a complete guide, please refer : https://docs.splunk.com/Documentation/AddOns/released/ServiceNow/About Hope this helps. ... View more

Both the searches should be present in single search string. It will be a great help if you provide me some sample search strings. ... View more