Hi! I currently have a csv file which shows the expected time my daily reports should be sent out. I also have a search which displays the time the report is actually sent and have created a field called "Delay" which shows the difference between the expected time and actual time. My issue is, if I wish to search events on a range e.g. for the past week and find their delay for each day: if i have a report that wasn't sent out on Monday as expected, but instead was delayed to Tuesday, the "Delay" value is only comparing to an expected time rather than an expected time and date, hence the delay is 0. i.e reports on the 2nd and 3rd of January were delayed till 4th of January. Yet as they were sent at a time before the expected time, the delay shows 0, rather than the correct value of over a day. Any ideas? Thanks in advance   ... View more

Hi!, So my search query looks up an Excel Spreadsheet with a column called Time, that is populated with a time e.g. 10:00 AM (no date included) However, when I lookup this field in the splunk query, I notice that the Time Field is now associated with today's date. E.g 08-01-2021 10:00.  This is an issue as I am trying to see if the event(time without the date) has occurred between two specific date and time ranges.  I.e trying to see if an event with a time 10:00AM has occurred between 02-01-2021 and 03-01-2021. As splunk associates the time with today's date, the event is not being picked up as it is linked to today's date and thus not within the date range. Any ideas? Thanks in advance ... View more