The reason the time period of the execution frequency is not the same as the execution frequency is so we don't miss a 3-event occurrence that straddles two periods. If we ran it once every 60 minutes looking back 60 minutes, we wouldn't get duplicates, but we'd also miss the case in which one event occurred just before the last 60 minutes, and 2 occurred just after the start of the period. I will investigate stats count BY host, thank you. ... View more

I have been using verbose mode for the event details. I have not used appendpipe, though, so I will look into that. Thank you! ... View more

Simple and very helpful. Thank you. ... View more

Thank you! This is great material, especially for a Splunk beginner. I will digest this for a bit. ... View more

I added sort by uid, and it did. It still shows the uid just as part of the big event record. What would be nice would be if I could pull it out to the side, so the recipient of the report could quickly see that uid 12345 had 5 events, and uid 67890 had 9 events, rather than just the detail event records. In other words (mocked up output): uid 12345       total number of events: 5    event detail1    event detail2    event detail3     etc. uid 67890       total number of events: 9     event detail1     event detail2     event detail3     etc.   Also, in case you couldn't tell, I am a beginner at Splunk. Thank you for your help.     ... View more

Very helpful, thank you. I will now play with eventstats, to try to refine the results. Using stats I had two rows, one for each where the count > X. Now with eventstats I get individual rows for each of the events that made up the two stats rows. So, for X=4, I had 2 rows with counts of 9 and 5, respectively. Now I'm seeing 14 events returned. Definitely closer to what I'm looking for. ... View more