So I’m pretty new to splunk and I do feel like this should be a lot simpler than I’m making it. I need two epoch times that are in the same cell to be substracted from each other and I haven’t been able to find anything that can help with it or figure it out myself. I didn't want to use mvexpand because I want the subtraction to be based off of the user   My search result looks like this rn: Name Epoch UserA 1625037039 1625037045 UserB 1625050381 1625050423   ... View more

Hello, I'm new to Splunk and trying to add a logo/icon to an app. I've followed the guidelines for required filenames and dimensions(also tried to make the dimensions smaller than the max).   I was unable to find this -> $SPLUNK_HOME/etc/apps/appname/static/ So I've saved it in /opt/splunk/etc/apps/appname/static - assuming it's the same, but maybe I'm wrong? The folder static didn't exist before i created it. I've restarted my Splunk and nothing, hopefully somebody can tell me what I'm doing wrong.   ... View more