If your boundary is the previous month between 8:00 AM local time on the first day of the month and 8:00 AM local time on the first day of the following month, you can set time constraints in the base search: ... earliest=-1mon@mon+8h latest=@mon+8h When user activity crosses time boundaries, where do you begin counting time? For example: Mar 1 14:30 user=foo src_ip=10.0.0.1 src_port=65535 dest_ip=10.1.0.1 dest_port=80 dest_service=http Mar 1 17:45 user=foo src_ip=10.0.0.1 src_port=65535 dest_ip=10.1.0.1 dest_port=80 dest_service=http Do you begin counting at 17:30 with the assumption the user has been working since 14:30, or do you begin counting at 17:45? For simplicity, I'll assume 17:45 and report the duration of observed activity. This returns _time values after 5:30 PM local time or before 8:00 AM local time: | where (_time > relative_time(_time, "@d+1050m")) OR (_time < relative_time(_time, "@d+8h")) 17:30 to 08:00 is less than 24 hours, so we can shift _time values by eight hours (28,800 seconds) to align or normalize them to the same calendar day: | eval _time=_time - 28800 Finally, we can calculate the range (duration in seconds) of _time by day and user and then sum the duration for a grand total: | bin _time span=1d as date_day | stats range(_time) as duration by date_day user | stats sum(duration) as duration by user | fieldformat duration=tostring(duration, "duration") Using Splunk audit data as an example: index=_audit user=* earliest=-1mon@mon+8h latest=@mon+8h | where (_time > relative_time(_time, "@d+1050m")) OR (_time < relative_time(_time, "@d+8h")) | eval _time=_time - 28800 | bin _time span=1d as date_day | stats range(_time) as duration by date_day user | stats sum(duration) as duration by user | fieldformat duration=tostring(duration, "duration") You can extend stats with additional fields as needed: | stats range(_time) as duration by date_day user src_ip src_port dest_ip dest_port dest_service | stats sum(duration) as duration by user src_ip src_port dest_ip dest_port dest_service | fieldformat duration=tostring(duration, "duration") The fieldformat command uses the tostring function to display the duration field (in seconds) in duration format: [d+]HH:MM:SS[.FFFFFF]. The underlying duration field value remains a decimal number. ... View more

@rayar  Raw data is compressed (see journalCompression in https://docs.splunk.com/Documentation/Splunk/7.3.4/Admin/Indexesconf), but it is not encrypted. Splunk offers encryption at rest in the Splunk Cloud product. On-premise solutions would typically use file system or block level encryption. ... View more

@tkerr1357  If your perfmon input interval is 90 seconds, then Disk_Transfers = 90 * 'Disk_Transfers/sec'. You can displayed corrected Disk_Transfers/sec and Disk_Transfers values for any time span using this:   index=perfmon host=myhost01s* sourcetype="PerfmonMk:LogicalDisk" instance=_total | timechart fixedrange=f minspan=90s per_second(eval(90 * 'Disk_Transfers/sec')) as Disk_Transfers/sec sum(eval(90 * 'Disk_Transfers/sec')) as Disk_Transfers by host If your interval is unknown, you can estimate it from data: index=perfmon host=myhost01s* sourcetype="PerfmonMk:LogicalDisk" instance=_total | streamstats current=f last(_time) as last_time by host | eval interval=_time-last_time | where NOT isnull(interval) | timechart fixedrange=f per_second(eval(interval * 'Disk_Transfers/sec')) as Disk_Transfers/sec sum(eval(interval * 'Disk_Transfers/sec')) as Disk_Transfers by host Note that your tails may not cover an entire span. E.g. If timechart chooses span=1h and your search time range is not snapped to the nearest hour with @h, then your first and last values will be skewed by missing data.   ... View more

@r35  Treat each serve as a series of data. For first-serve, you have points (4.5,-0.3) and (3.5,15.6), for second-serve you have points (4.5,-0.3) and (3.6,16.0), and so on. As with the answer to your earlier question, use xyseries to chart the y-axis value over the x-axis value by series:   | makeresults | eval _raw="serve,xpoint,ypoint first-serve,4.5,-0.3 first-serve,3.8,15.6 second-serve,4.5,-0.3 second-serve,3.6,16.0 third-serve,4.6,-0.2 third-serve,3.8,16.3 fourth-serve,4.7,-0.4 fourth-serve,3.9,16.5 fifth-serve,4.6,-0.5 fifth-serve,4.0,16.9" | multikv forceheader=1 | xyseries xpoint serve ypoint   xpoint fifth-serve first-serve fourth-serve second-serve third-serve 3.6       16   3.8   15.6     16.3 3.9     16.5     4 16.9         4.5   -0.3   -0.3   4.6 -0.5       -0.2 4.7     -0.4       Under General chart options for the line chart, select the "Connect" option for null values to draw lines between the points. See the Splunk Dashboards app for fun ways to position and size charts over background images. ... View more