I have this query which is working well in Splunk8 whereas I am getting timechart with wrong values in Splunk9. Is there any chage in timchart or case function that may cause this query not to work perfectly?   index=my_index sourcetype=jetty_access_log host="apiserver--*" url="/serveapi*" | eval status_summary=case(status<200, "Invalid",status<300, "2xx", status<400, "3xx",status <500, "4xx",status<600, "5xx",True(),"Invalid") | timechart span=5m count(eval(status_summary="2xx")) as count_http2xx, count(eval(status_summary="3xx")) as count_http3xx, count(eval(status_summary="4xx")) as count_http4xx, count(eval(status_summary="5xx")) as count_http5xx, count(eval(status_summary="Invalid")) as count_httpunk This screenshot below shows the correct result (Splunk 😎   This screenshot shows the incorrect result ( Splunk 9)       ... View more

Hi, I have enabled SSO authentication for my splunk instance. However, I am still able to login as local user with en-US/account/login?loginType=splunk option. Is there an option to disable this bypassing to tighten security? ... View more