or make a timechart ... View more

Use the alert condition "if number of events" > 1 in the Splunk UI. You can also add the below condition to the savedsearch.conf as well: quantity = 1 relation = greater than Thanks ... View more

In the search app you get a humanly readable conversion for _time by automagic, underneath it's epoch seconds there as well. You can verify this by adding | eval foo = _time to some query, it will show epoch seconds for fóo and humanly readable for _time . Manually, this for-view formatting without changing the underlying value is invoked by the SPL command fieldformat , see more explanation there. ... View more