Hello, I am trying to use Streamstats with Sum(value) and I want to reset that sum after it reaches a certain threshold (in the example below this threshold is 1000). The Splunk documentation states that "The eval-expression can reference fields that are returned by the streamstats command. "   However it is completely ignoring my reset_after clause, any help is much appreciated. Example below:     index=events |table id,_time |sort 0 -id, _time |streamstats current=f reset_on_change=true last(_time) as last_seen by id |eval time_delta=_time-last_seen |sort 0 -id, _time |streamstats reset_after="("running_time>=1000")" reset_on_change=true sum(time_delta) as running_time by id   Splunk reference: reset_afterSyntax: reset_after="("<eval-expression>")"Description: After the streamstats calculations are produced for an event, reset_after specifies that all of the accumulated statistics are reset if the eval-expression returns true. The eval-expression must evaluate to true or false. The eval-expression can reference fields that are returned by the streamstats command. When the reset_after argument is combined with the window argument, the window is also reset when the accumulated statistics are reset. ... View more