Figured it out... | inputlookup append=true Provider_Alert.csv where Tier=Tier1 Active="TRUE" | join type=outer [ search index=wsi sourcetype=fdpwsiperf intuit_offeringid IN ("Intuit.tax.ice.ice", "Intuit.platform.turbotaxwindows","Intuit.tax.ctg.ice.109ximportwidget","Intuit.platform.turbotaxipad.turbotaxmac") api_version=* tier=Tier1 | eval offering=if(in(intuit_offeringid,"Intuit.tax.ice.ice","Intuit.tax.ctg.ice.109ximportwidget"),"TTO","TTD") | eval Provider_ID=coalesce(partnerId, legacy_id) | search Provider_ID!=*test* | chart dc(intuit_tid) as import_activity OVER Provider_ID BY offering | fields Provider_ID *] | fillnull ... View more

By default, returns returns a field name, not a value. To get the value, use | return $total_events . ... View more

I figured it out. It's the fieldformat that's the constraint. I removed it and I achieved what I wanted. ... View more

You can avoid the separate rename command by using the as option in streamstats . | streamstats sum(*) as * ... View more

You can fix this in your base search. You currently have: ((index=wsi_tax_summary sourcetype=stash capability=109* tax_year=2019 ein=* earliest=1578096000 latest=now()) OR (index=summary_dac_tax partnerId!=*Test* tax_year=2018 capability=*109* tax_year=2018 earliest=1546560000 test=1556668800)) (intuit_offeringid=Intuit.platform.turbotaxipad.turbotaxmac OR intuit_offeringid=Intuit.platform.turbotaxwindows OR intuit_offeringid=Intuit.tax.ctg.ice.109ximportwidget) error_msg_host=SUCCESS partnerId!=*test* partnerId=* | (evals and stuff...) All those latest=xxxx and earliest=xxxx clauses can use relative time modifiers. So you can, much as anmolpatel hinted at, do things like this (Trimming out lots of extraneous stuff): ((index=wsi_tax_summary sourcetype=stash capability=109* tax_year=2019 ein=* earliest=-1y@y latest=@y) I recommend taking a simple search and playing around with those to see their effect, and make sure you understand the difference between @y , -1y@y , and even mixed up things like -1y@w which goes back 1 year, to the closest week to now. (Right now on March 14th 2020, it goes back to March 10th 2019 for me.) I think with a little use of relative time modifiers, you can achieve what you want. If you get stuck with anything particular - try it in a simple search, like in your case maybe just one piece at a time, like index=wsi_tax_summary sourcetype=stash capability=109* tax_year=2019 ein=* earliest=-1y@y latest=@y Happy Splunking! -Rich ... View more

The answer to your question can be found from this Accepted Answer in Splunk Answers. https://answers.splunk.com/answers/243063/when-you-feed-multiple-field-names-to-the-top-comm.html ... View more