Hello my friends, I'm new to splunk and still trying to figure out the ins and outs of everything. I have a report that's been handed down to me that I'm trying to improve on it's timing. The report runs at 3 AM EST every day, but sends out at 8 PM that night. I suspect this has to do with the amount of data the report is trying to collect and then display. To fix that, I want to trim down how much data we are building, but I don't know if it will actually help. What we are currently showing is how many times each of our 320 dispensers are dispensing, how many of each error they are getting, the error rate, and their total # of errors. What I am thinking of doing is focusing on the total # of errors. Specifically, if a dispenser returns 0 errors, it's not in the report. Currently, the TotalErrors column is evaluated like this : | eval TotalError=(Error1+Error2+Error3) My thoughts are to evaluate against TotalError and if the # of errors = 0, not to display that dispenser. ... View more