Hi, We have a custom search that should alert when a critical host, that we have defined in the search, is missing. The issue we're having is that we haven't been alerted on some of the hosts not having logs because the last time they had any logs was an age ago. When I change earliest=-1d to earliest=-1y the hosts I want appear but the search takes a longer time.  Is there a way to make it so for every host value specified, a stats line is created where I can fillnull the fields as appropriate? Here is the search: | tstats prestats=true count where index="*", (host="host01" OR host="host02" OR host="host_01" OR host="host_02") earliest=-1d latest=now by index, host, _time span=1h | eval period=if(_time>relative_time(now(),"-1d"),"current","last") | chart count over host by period | eval missing=if(last>0 AND (isnull(current) OR current=0), 1, 0) | where missing=1 | sort - current, missing | rename current as still_logging, last as old_logs, missing as is_missing ... View more

Hi, I have several datasets that have the exact same format with only the source of the data differing. I've duplicated my macros from the dev environment to the test but I'm receiving no results for the test macro, despite when I do the tstats search as a datamodel instead I get results. Here is the dev search:  tstats summariesonly=true count("dev_metric.exchangeId") as avg_TPS from datamodel=metric by _time, dev_metric.date span=1s | search "dev_metric.date"=$date$ | stats avg(avg_TPS) as averageTps by dev_metric.date | eval averageTps=round(averageTps/1000,3) | appendpipe [tstats count | where count=0] | fillnull value=0.000 averageTps | fields averageTps   Here is the test search: tstats summariesonly=true count("test_metric.exchangeId") as avg_TPS from datamodel=metric by _time, test_metric.date span=1s | search "test_metric.date"=$date$ | stats avg(avg_TPS) as averageTps by metric.date | eval averageTps=round(averageTps/1000,3) | appendpipe [tstats count | where count=0] | fillnull value=0.000 averageTps | fields averageTps I've checked the dataset and there are the needed events in there, and I've done a | datamodel search equivalent to tstats that worked fine. What could be the reason I'm receiving no results? And what could be some steps to resolve this? ... View more

Hi, I have a field value 2021-07-26T00:30:51.411 UTC which I got from | eval strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q %Z")  how can I turn this field into the Brisbane timezone (+10 hrs)? ... View more

Is there a way to specify a timezone in a datanmodel? I have an eval field called date relying on Splunk's _time field but I want to ensure that it matches a specific timezone, rather than relying on the extracted _time of the log as its in UTC. I want to have the timezone match Brisbane, Australia (+10) ... View more