What you want to do, is on the target view if you're not yet using a Button module after your form fields, add one. (Make sure it's a Sideview Button module and not the core Splunk "SubmitButton" module) and then add this param: <param name="allowAutoSubmit">False</param> allowAutoSubmit is a cousin of allowSoftSubmit, but allowAutoSubmit is designed for exactly this use case. To explain further, the more widely known allowSoftSubmit param, set to True/False, governs whether the Button should let through any upstream pushes that come from a user changing a Pulldown, clicking a Checkbox, changing a selection in Pulldown etc... And "allowAutoSubmit", that you also set to True/False, governs whether the Button should let through any pushes that come from the page load. some examples to show how these two params represent independent behaviors: On page load the form will populate but NOT submit whatever searchesa re after the Button. After page load though, the user doesn't have to hit the button explicitly, they can just hit return in TextFields or make selection changes. <param name="allowSoftSubmit">True</param> <param name="allowAutoSubmit">False</param> On page load the form will submit the search. However afterwards the user has to explicitly hit the green button to resubmit the search. <param name="allowSoftSubmit">False</param> <param name="allowAutoSubmit">True</param> ... View more

| eval te=strptime(t,"%b %d %T %Y %Z") | eval tl=strftime(te,"%b %d %T %Y %Z") You need to include the timezone capture (%Z) so that splunk can calculate what the offset needs to be. ... View more

Just to make a tweak to your regex: rex "Contract\s+(?P<CONTRACT>.+\s+expires on\s+)(?P<EXPIRES>.+)" This cleanup will not put "expires" in the CONTRACT, prevent misparsing of the CONTRACT name (if there is "on" in the name), and eliminate the space at the front of EXPIRES. Question: what result do you get from your dysfunctional query? ... View more