Thanks, I eventually came to something similar!  I think this is the solution I am after, unless you can spot a hole in the logic.   | eval seconds_taken = time_taken/1000 | eval responded = _time, requested = _time - seconds_taken | where requested <= responded AND seconds_taken > 0 ``` | where requested <= responded AND seconds_taken >= 0 ``` | timechart count span=1s   ... View more

The instance of "Stream=True" that you are referring to is not related to any part of the request to Splunk's REST API. This is part of the python requests module/library that, if the response is available as a stream, reads the response as a stream.  Further into the script this allows for the results to be written "live" as they are returned... instead of as one massive 2,924,899 line file.  In essence, this is a band-aid to patch the issue I am actually asking in my question. ... View more

The trouble is not the timeout.  When the Splunk search is complete the results are successfully moved into an output file.   I am interested in learning how to return only the final results of ~300,000 rows from Splunk.  The current URI path and parameters are leading to an output of more than 1,924,900 rows.  I think this is some indication that Splunk is streaming "live" results and I only want the final results. ... View more

Thank you for your reply @renjith_nair but I am trying to create a table.  The chart command I am using creates the intended format... but the table command does not.   Do you know why this is happening? ... View more

Thank you for trying to respond, but this doesn't answer the question.  The closest answer appears to be the tostring function, but it also changes the datatype.     … |stats sum(eval(sc_bytes/1073741824)) AS Gigabytes BY date | eval Gigabytes = tostring(Gigabytes, "commas")   ... View more

@nick405060 This works for me, but my global variable is the sum of a very lengthy search.   For as long as the search that creates the global variable is running, the search that uses starts, cancels itself, and then starts again, over and over and over.  All searches eventually run as expected, but its not pretty to look at.   Is there a way to hold the dependent search from starting until the global variable has been created? ... View more

Thank you for the reply but it doesn't really help.  I am looking to create a Gantt style chart without incorporating additional plugins or apps ... View more

This is great, but how are you the poster with the correct answer to every one of my questions!?  😂 ... View more

Hello @kkrishnan_splun and @niketn This is amazingly helpful and seems like a great way to add one of the best features of Tableau to Splunk's dashboard.   I have three questions that I will need to answer before I suggest this to my organization:  Would this JS file need updated every time a new dashboard or panel is created? Could one, in theory, just write the JS file for 10 panels...   <panel id="tooltip_panel1"> <panel id="tooltip_panel2"> <panel id="tooltip_panel3"> ... ... //On mouseover() event set the show token for the Tooltip $('#tooltip_panel1').on("mouseover",function(){ var tokens = mvc.Components.get("submitted"); tokens.set("tokToolTipShow1", "true"); }); //On mouseout() event unset the show token for the Tooltip to hide the same. $('#tooltip_panel1').on("mouseout",function(){ var tokens = mvc.Components.get("submitted"); tokens.unset("tokToolTipShow1"); }); $('#tooltip_panel2').on("mouseover",function(){ var tokens = mvc.Components.get("submitted"); tokens.set("tokToolTipShow2", "true"); }); //On mouseout() event unset the show token for the Tooltip to hide the same. $('#tooltip_panel2').on("mouseout",function(){ var tokens = mvc.Components.get("submitted"); tokens.unset("tokToolTipShow2"); ...   ...and the option to use the extra XML would then be available -- in any Dashboard -- for any panel, named tooltip_panelx ? If the naming convention was panelx (as in the example) and not tooltip_panelx  (as in my last question),  would this change have any affect on the usability or performance of other panels with the id="panel1"  that are not embedding the additional XML for these tool tips? Thank you, ... View more

The head command appears to work correctly, but the results do not match up.  In the attached screenshot the values that have the greatest value in GB do not have the greatest value in Bytes.   ... View more

That produces a result but it doesn't help me very much.  I need to perform this function on all the events in the dateset and use the percentage later in another function.  Can you tell me how to find the percentage for all events and save the result? ... View more