I am with the same problem... Any idea ?? ... View more

Banderson, I don't know, if you opened the ticket. In my case, I was installing the SA-ldapsearch on search head... but, the correct is installing on indexer.. that corrected my problem ... View more

Try with stats command | stats sum(TotalMinutes) as Total_Minutes, sum(TotalDisconnectedMinutes) as TotalDisconnected_Minutes by date_mday this will work better you can put the day and month in the same field, like eval current_date= date_month +"/"+ date_mday ... View more

What are you what to do is this? your search * | table Product, Version | join Product [ | inputlookup | eval LastVersion=Version | table Product LastVersion] than you can compare the different versions where Version!=LastVersion ... View more

what you want is join two search whit the same field/value ? something like this? index=apic component=faultInst | eval cT = strptime(created, "%Y-%m-%dT%H:%M:%S.%3N") | eval early = relative_time(cT,"-1m") | eval c1 = strftime(early,"%m/%d/%Y:%H:%M")| table c1 | join c1 [ index=apic component=aaaModLR |eval created=c1 | table created,affected, c1] http://docs.splunk.com/File:Join.png ... View more

Tks.. its help me to ... View more