For the record, I ran into a case, when I run into the error message. It was when I needed to replace an existing csv file for lookup.  I forgot to delete the existing one, and hoping the new file will override the existing one. It turned out that Splunk just complained without clearer indication of my offense. It would have been more helpful with more concrete error diagnose. ... View more

search severity > 9 customer="name" | eval Week=relative_time(_time, "@w1") | stats count by severity customer Week | eval n="count" | xyseries Week, n, count though I am unclear on why you want count by severity and customer as well as by week... ... View more

Thank you so much! (?m-s) does get this working. ... View more