Thank you so much for the explanation. This make so much sense when you describe it (and something I should be able to think of my self).  ... View more

Finally! I just got the license. ... View more

Hi @damo66a  Did you figure out this issue?  I also have issues that powershell scripts doesn't seems to be triggered after a while (after working for days and weeks). Restart of the splunk service helps, but after some time it stops again. I can't find any error messages either. Regards ... View more

Hi After running "splunk btool outputs list --debug" it finds all the outputs.conf files except the one that's in the app I created. I've checked the folder and files and it has exactly the same read permitions as the $Splunk_Home\etc\system folder. Do you have any sugestions what this means? Thank you so far! ... View more

@HaakonRuud Please check out following search and let me know if it could be helpful and lead you into the right direction. I'm currently not sure of the provided conditions and their time frames. Maybe someone else has a smarter way. | makeresults count=8 | streamstats count | eval event_id = case(count=1, "21", count=2, "25", count=3, "24", count=4, "24", count=5, "24", count=6, "21", count=7, "21", count=8, "25") | eval _time= case(count=1, "1673274655", count=2, "1673273755", count=3, "1673272855", count=4, "1673271955", count=5, "1673271055", count=6, "1673270155", count=7, "1673269255", count=8, "1673268355") | eval user = case(count=1, "userA", count=2, "userB", count=3, "userA", count=4, "userB", count=5, "userA", count=6, "userC", count=7, "userB", count=8, "userA") | stats list(event_id) as event_ids by user | makemv delim=";" event_ids | eval status=case(event_ids LIKE "25%","active",event_ids="21", "active", 1=1, "inactive")     ... View more