Hi , Am using Splunk Enterprise Version:7.3.3. Still cant see drop down option for my saved search report even though I use below lines in my savedsearch.conf file.   action.summary_index = true auto_summarize.dispatch.earliest_time = @w0 ... View more

Thank you so much @ccuadrad, You have saved my day. This was doing my head in and such a simple fix! ... View more

Ok - Thanks . I will download the Splunk app to our Dev server and see if it will work for us. Thanks again. ... View more

Lets see.... The update produces these results : Avg_Response_Time= 00:00:11.744500 Max_Response_Time= 00:00:16.711000 The service field contains no results, even after modifying to include service in the table | service, Avg_response_Time, Max_Response_Time. Removing the last | "each * [eval <>=tostring('<>',"duration")]" ( Not sure what this part of the query does - can you explain?) produces these results and shows data for the service field: service =quote/save Average_Response_Time = 11.744500 Max_Response_Time =16.711000 I think we are very close! For the formatting, I'm wondering if we can filter to show two places after the decimal and up to 4 place markers before : 00:00.00 ? Thanks! ... View more

If possible, can you clean that index and re-index the file after you've made that change? Can you also post the updated version of the csv file once they've changed it so we can confirm it looks correct? Thank you, Ryan ... View more

Yes -"count" is an existing field . This worked - Thanks for the answer! ... View more

In props.conf you need KV_MODE=multi - Used for search-time field extractions only. - Specifies the field/value extraction mode for the data. ... View more

Thanks for the alternate answer. I reverted my changes and updated the [settings] option as you described above! ... View more