It didn't like the index command inside the search.  I didn't spend much time troubleshooting it, since the answer above ended up working for my needs.  Thank you for taking the time to reply. ... View more

This worked perfectly!  Amazing to run your search step by step to see how you solved this.  You gave me an education in Splunk, thank you very much for your efforts!  I'm marking your first answer as the solution since it's simpler and solves the original question that was asked.  Thanks again for your help! ... View more

This works, however the other wrinkle is that I have another column i want to do a count() on called INCIDENT_ID. | timechart span=5m count(INCIDENT_ID) as CURRENT_INCIDENTS sum(OUT_CUSTS) as CURRENT_OUT by DISTRICT | fillnull value=0 | untable _time DISTRICT CURRENT_INCIDENTS_OR_OUT Gives me results that look like  _time DISTRICT CURRENT_INCIDENTS_OR_OUT 10:00 CURRENT_INCIDENTS: ABC 5 10:00 CURRENT_INCIDENTS: XYZ 4 10:00 CURRENT_OUT: ABC 1 10:00 CURRENT_OUT: XYZ 1   So I end up with the INCIDENT count and CURRENT_OUT sum in the same column Am I out of luck?  Either way, what you've been able to show me is nothing short of wizardry and I thank you for your help! ... View more

Wow!  This is so close to what I needed, thank you!  The only issue is with the latest(CURRENT_OUT)  | stats max(CURRENT_OUT) as PEAK_OUT latest(CURRENT_OUT) as CURRENT_OUT by DISTRICT   Many times, a district will not have any data for a given time slice.  I would only want to bring back a non-zero value if the timestamp was the "latest" time slice, here's an example where 8:00am is "latest": _time DISTRICT OUT_CUSTS 8:00am A 15 7:55am A 10 7:50am A 23 7:55am B 1 7:50am B 3   Desired result: DISTRICT CURRENT_OUT PEAK_OUT A 15 23 B 0 3   Actual result: DISTRICT CURRENT_OUT PEAK_OUT A 15 23 B 1 3   Here B has no 8:00am data.  latest(CURRENT_OUT) returns the value 1 from the 7:55am time slice, but I want to see 0 because there is no data for district B for 8:00am.   Is there a way to accomplish this without changing the way data is being fed into splunk?   ... View more

@richgalloway  Ok, got it.  I did that, but none of the results returned came back with the database input that i am looking for.  I see in the search window there is a timeframe next to the search -  i set that to "Today" since i accessed the dashboard that uses my database input several times today.   And just to clarify, since im so new to Splunk, I am searching the results for the name of the database input that i see in the Data Lab->Inputs tab.  Does this sound correct?  I need to determine why i'm not finding the database input that I know exists and is being used, then go from there.  I appreciate your input ... View more

@richgalloway Thanks for the reply.  I am completely new to Splunk and some of your replay went way over my head.  Where would I use the REST command that you provided?  Could you attach a screenshot? ... View more