Hi, I have a base search and post process searches on a dashboard that need to be split by source, but it doesn't appear like splitting by source works. The only thing shared is the index, and some fields but depending on the source I need to evaluate the fields differently. For instance: Base search: index=test_logs | fields A   Two post process searches: | search source=sourceA . (evaluate field A certain way because it's from source A)   | search source=sourceB . (evaluate field A a different way as it's from source B)   The problem is that when I do this nothing will load. I've found the only way to get this to work is to put the source in the base search but then I wouldn't be able to do my evaluations properly. ... View more

I haven't found something for this time format in the docs: Mon Sep 28 00:00:00 GMT 2020 How can I convert this with strptime()? How do I make sure the "GMT" part of the string isn't interfering? ... View more

I have a search:      search | eval difference=now() - strptime(createdDate,"%Y-%m-%d %H:%M:%S.%3N")      This works, except the createdDate field from my results are in GMT+0, whilst I'm in GMT+10 so there's 10 hours added to every result. I was going to just do a -36000 bandaid fix but after daylight savings this would break. How can I get current GMT time? ... View more