Hi Everyone, Data coming in from an API is using the _indextime as the _time field because the timestamp format that is being sent is not recognised by Splunk. An example of the timestamp would look like this:     2016-06-21T01:18:51-07:00     OR     2018-02-16T06:34:31-08:00      As you can see, an offset of -7 or -8 hours is being added to the time field. The timestamp format we`re currently using for the sourcetype is:     %Y-%m-%dT%H:%M:%S%:z     This is no longer working after the sender made some changes to the timestamp, but I`m not entirely sure how to represent the new format. Using Splunk Cloud.  Any help would be greatly appreciated. Toma. ... View more

Hi, We`ve got a dashboard sitting on a problematic SH and would like to clone and move it to another working SH. Is there a way to redirect the users to the newly created cloned dashboard ? Many thanks, Toma ... View more

Hi, I have a dashboard that runs off the back of a report that is scheduled to run every minute. I need to amend the report schedule to run every minute between the specified hours AND every 5 minutes outside those hours to save on resources. My current cron expression looks like this:   */1 * * * *   To run every minute between the specified hours, I could write something like this.   */1 3-8,12-20 * * *   The question I have is how to add a clause to schedule the search to run every 5 minutes outside those hours? Many thanks.  ... View more