You could use streamstats to add the next event's timestamp to each event, calculate the difference, use that as valid duration for the event and hence have an approximation of the time during which your CPU was greater than 90%. Not having a dedicated command for this special case makes this special case a bit harder to build, but having powerful generic commands makes it possible in the first place. Imagine how many very very specific commands there would have to be to cover every possible eventuality. ... View more

Hi Martin, After a bit of a search, it turns out that Splunk provides for this, however just not in a pretty GUI. Have a look here: http://docs.splunk.com/Documentation/Splunk/latest/Developer/TranslateSplunk#Localize_dates_and_numbers Hope this helps 🙂 EDIT: Just as I clicked away, I think I just got what you were after. What if I had a file that was created by a system that used a decimal comma for localisation and I wanted to index & report on that along with files created in places that used a decimal point. Being able to specify the number localisation by host/source/sourcetype would be quite useful for this kind of scenario. ... View more