Not in the near to distant future. If you talk to you account rep, ask them to file an ERD and request this. That can help!! ... View more

The original python script controlling the $trigger_timeHMS$ is sendemail.py in $SPLUNK_HOME/etc/apps/search/bin/ For my case, I did the followings, 1) make a copy of this sendemail.py to $SPLUNK_HOME/etc/apps/my_app/bin/ 2) modify the following line ssContent['trigger_timeHMS'] = time.strftime("%I:%M:%S", triggerSeconds) to ssContent['trigger_timeHMS'] = time.strftime("%H:%M:%S %Z", triggerSeconds) or other time format 3) create a new commands.conf in $SPLUNK_HOME/etc/apps/my_app/local/ and copy the [sendemail] section from $SPLUNK_HOME/etc/apps/search/default/commands.conf [sendemail] filename = sendemail.py streaming = false run_in_preview = false passauth = true required_fields = changes_colorder = false supports_rawargs = true undo_scheduler_escaping = true 4) restart or debug-refresh Splunk to make the configuration effective 5) create the alert under my_app and use $trigger_timeHMS$ in your alert email subject or content ... View more

How about | dbxquery connection=databasecon1 query="select @@servername" | union [ dbxquery connection=databasecon2 query="select @@servername"] | union [dbxquery connection=yetanotherdb query="select@@servername"] ... View more

This is a whole different plugin, I really cannot say. You should open a new question. ... View more

Sure, I think you can eliminate appendcols altogether in this search. Try something like this: sourcetype="my_source_type" source="frt" (url="/F-" OR url="/P-" OR url="/C-*" OR url="/main") | eval Identifier=case(url == "/F-", "Family",url == "/P-", "Product",url == "/C-*", "Category", url == "/main", "Homepage") | timechart avg(download_time) by Identifier ... View more