There's another way to see whats happening, you can check out this blog entry by Amrit: http://blogs.splunk.com/2011/01/02/did-i-miss-christmas-2/ Basically, we just need to figure out if splunk is actually reading the file or if for some reason it marked it as not readable due to crc issue, etc. ... View more

timechart can graph more series: ... | timechart limit=0 span=1h values(USED) by NETWORK There's not much point in the sort , since timechart will sort by time first, and the columns will be sorted lexically. ... View more