Not joking .  I was going about this the hard way and wasted so much time , but this worked  index=sysmon  <U+202E>   ( This is invisible . You will not see it when you paste it in Splunk) | stats .. ( your query)   In sysmon the CommandLine and Targetfilename is were you would see the RTLO operation ... View more

thank you very much Rich. You explained it in a way that makes send to me ... View more

@aweitzman i want to achieve the same thing in current splunk .  the query above is not yielding any results. ... View more

You could use the coalesce command to merge the two fields into a single field: BASE SEARCH | eval AgentVersion = coalesce(AgentVersionold,AgentVersionnew) | stats count by AgentVersion ... View more

How about this your base search cs_bytes>sc_bytes e.g. index=foo sourcetype=bar cs_bytes>sc_bytes ... View more

I would use streamstats like this: (index=A other filters to get IN/OUT time) OR (index=B other filter to get Windows sercurity logs) | reverse | streamstats current=t latest(userStatusFieldThatIsEitherInOrOut) AS lastStatus by userIdField | where lastStatus="Out" AND EventCode="LoginCode" ... View more

much thanks for assisting Rich. I am pretty amatuer with Splunk now. Yes, it was originally configured with fix start/end and i thought the cron setup will implement the date change, but I see cron is only for setting up when the report is supposed to run. I will setup the relative time in the **Advance->Earliest/Latest section? Let me see if I can get my head around setting up relative time before asking you the another question:) appreciate your help. ... View more