To dIagnose these problems run the outer search on its own and the inner search on its own. You are using join, which is not necessary and may be the issue depending on your data size. You don't need the table commands all the time and you seem to be duplicating your time parsing (time and _time). Not sure you need reverse either - in the join, you are reversing to get the first timestamp, which in practice without the reverse would be the oldest _time, so you could just to earliest(timestamp) instead without reverse.   ... View more

Panels are expanded to take up as much space as is available - if you want the reduce the available space, put another panel in the same row. ... View more

Hi maybe it’s more efficient to fix your SPL to give the same result with fast mode?  r. Ismo ... View more

Could you confirm or deny that when "Delta value is coming as 'negative' or 'zero'", you performed extra sort on _time? Or is the natural order already in decreasing _time order so no exclusion should be necessary in the first place? The section you marked are not all in decreasing order.  Only the first one in the group (2021-08-09 12:26:39.286)  is 17 seconds earlier than the previous one (2021-08-09 12:26:56.393).  Not only is each of the following timestamps later than 2021-08-09 12:26:39.286 (first one in the group), but also each is later than the one preceding it.  For example, 2021-08-09 12:26:40.343 is 1 second later than 2021-08-09 12:26:39.286; 2021-08-09 12:26:41.348 is another 1 second later than 2021-08-09 12:26:40.343; and so on. What I really mean is: Why shouldn't these events be sorted to order (descending or ascending)?  Is there any significance/meaning of showing the disorder?  You can simply do | sort _time and the disorder will disappear. ... View more

Go to Splunkbase (apps.splunk.com) and search for "donut".  Download and install one or more of the apps.  The "Details" page for each app offers tips on how to craft a search to make use of the visualization. You may need to reformat your data so the "Completed" and "Crashed" values are in the same field because the visualizations will expect results from a command like stats count(status) by DeviceID. ... View more

Hi @kirthika26, if one answer solves your need, please accept one answer for the other people of Community or tell us how we can help you. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the Contributors;-) ... View more