Hi @berzerk, it depends on the timezone configuration you adopted: you could use the local time (eventually converting from _time knowing the user location) and so the business hours are the same. If instead you converted all the timestamps in your user time, you have to create a new field from _time to use for the check, but the approach is the same. Ciao. Giuseppe ... View more

Use zip or your favorite backup program to bundle-up %SPLUNK_HOME%\etc\apps\<app name> then copy the bundle to the other Splunk instance and un-bundle it.  "<app name>" refers to any app you installed on Splunk.  Do not copy built-in apps unless the two Splunk versions are identical.  You'll also want to copy %SPLUNK_HOME%\etc\apps\search\local\*. ... View more