You were absolutely right on the first point. I did drop the minute modifier on the time_window after contorting my example multiple times and not making any progress and as a result made typos. On the second point, below are the example searches and the outputs. Note, I did change the stats to use aggregator avg() instead of latest() from the streamstats. Now changing the aggregator was actually what was needed, solving my own problem, I think. I believe the issue was my use of latest load, 5min load, 15min load was the cause of the problem.  Please validate my thinking. How would getting the below example searches and output to compare or contrast help you enlighten me? <mysearch> | bin span=1m _time | eval load = round(PercentUserTime + PercentSystemTime, 1) | eval host="foo" | streamstats time_window=5m avg(load) as five_min_load by host | streamstats time_window=15m avg(load) as fifteen_min_load by host | timechart span=1m partial=false avg(load) as load avg(five_min_load) as five_min_load avg(fifteen_min_load) as fifteen_min_load by host _time fifteen_min_load: foo five_min_load: foo load: foo 2023-01-16 16:46:00 5.3 5.1 5.5 2023-01-16 16:47:00 5.3 5.5 17.2 <mysearch> | bin span=1m _time | eval load = round(PercentUserTime + PercentSystemTime, 1) | eval host="foo" | streamstats time_window=5m avg(load) as five_min_load by host | streamstats time_window=15m avg(load) as fifteen_min_load by host | stats latest(_time) as _time avg(load) as load avg(five_min_load) as five_min_load avg(fifteen_min_load) as fifteen_min_load by host | table _time host load five_min_load fifteen_min_load _time host load five_min_load fifteen_min_load 2023-01-16 16:55:00 foo 4.9 5.5 5.4   ... View more

I came up with my own resolution.  My initial data is already summarized into neat 10 minute sample buckets.  I set up a similar second summary to just capture just the maximums.  A subsearch on the secondary search gave me the historic data for capacity measurements.  I hope this helps someone else. index=my_summary report=summary_appservice source=summary_appservice | timechart span=10m sum(successful) as successful_transactions earliest=-1d | eval maximum_observed_transactions=[ `comment("Historic Maximum for capacity")` search index=my_summary report=summary_appservice_ceiling earliest=-3y latest=-1m | stats max(successful_transactions) as x | return $x ] | eval capacity = maximum_observed_transactions | eval utilization=successful_transactions/capacity*100   ... View more

Answered 4/5/2019 | lookup dnslookup clientip AS ip OUTPUT clienthost AS host ... View more

Answered in https://answers.splunk.com/answers/717313/how-do-i-do-a-reverse-dns-lookup-in-splunk-1.html ... View more

There has been a lookup dnslookup in splunk for a long time now. name to ip: | lookup dnslookup clienthost AS host OUTPUT clientip as ip ip to name: | lookup dnslookup clientip AS ip OUTPUT clienthost AS host ... View more

Setting window=1 didn't work for me, but current=t did. Thanks much ... View more

Yes, the extraction period is one day. Chart only allows one criterion or 'by' value. The requirement is to provide the highest value of distinct_mac for a given relay agent. I think that the method you offer is the total over all of the relay agents per chart time period ( 1 hour ). Using your method, the max_mac is identical over all of the relay_agents. I think I might be confused ... View more

Brute force, but simple.. I like the method. It reminds me of what I did in other programming languages. Tim ... View more

While sundareshr provided exactly what I asked for, unfortunately, I need something with higher performance. I believe that I will need to do something with summary indexes in order to complete in a reasonable time frame. None the less, I will accept this answer and rephrase / re-pose the question. Tim ... View more

I think this was what i was looking for. Why didn't I think of it "| chart count over subnet by time " is just what I was looking for. I will try it out, make a few modifications and likely accept this answer. Thanks, Tim ... View more

The aim was to count or chart over time. subnet, 0-30days, 31-60days, 61-90days, ... View more