As of Splunk 6 the Ctrl-X or Cmd-Z "Undo" action will only undo the keypresses you have typed since the last time you hit return. Once you hit return that history gets wiped and to return to the moment you hit Return, you have to use your browsers back button. And as you have found out, the browser's back button will redispatch that search. The only advice that I have, is that you can just wail away on the back button and forward buttons and let the crazy storm of search dispatches happen - the UI will be working very hard to cancel the one(s) that you dispatched moments before, but it will cancel them. Which just means you shouldn't worry about creating a lot of runaway searches on the host. It is frustrating though because the old behavior was much better and you could Ctrl-Z your way back with great precision and without any searches being dispatched until you hit return. I submitted this as an ER myself a ways back. And one final comment that may help, is that the Sideview Utils app does have a little sample interface that is a partial replacement for the generic search UI - with a relatively recent version of Sideview Utils you can navigate to "Apps > Sideview Utils > Sample Interfaces > Sideview Search, or just send your browser to /en-US/app/sideview_utils/sv_search If you don't have that view in your copy of Sideview Utils just update to the latest (3.3 as of this writing) ... View more

So after messing around a bit, I have found a clunky way to achieve what I wanted, may it helps other! First I have created a macro, that takes the last search of the jobs list with the given search name, and return its earliest time (MY_MACRO): MY_MACRO(search_name, "hours to subtract before earliest schedule time") [| rest /services/search/jobs | search label="$arg1$" | head 1 | eval earliest=substr(earliestTime, 1, 19) | eval earliest=strptime(earliest,"%Y-%m-%dT%H:%M:%S") | eval earliest=earliest-$arg2$*3600 | eval earliest=round(earliest, 0) | return earliest] Note that you shouldn't return $earliest as in a macro it will not work (maybe interpreted as an argument cause of the $ sign, see here. Then, take the search you want to backfill summary index, let's take index=MY_INDEX as an example (name it MY_SEARCH), and add the MY_MACRO value at the end, so the final search is: index=MY_INDEX MY_MACRO(MY_SEARCH, "hours to subtract before earliest schedule time") You can then use fill_summary_index.py with this search, the earliest time will be the scheduled time (the UTC+ ... time you can see in the console log), and not the time you run the search. Thanks very much to Ayn, Martin and alacercogitatus for the help, I think I'm done with it. ... View more

In fact, after experimentation, I was using the $s$ token inside another $value$ token inside a string, and I was using $s$ elsewhere directly, not in a string. So basically I needed two version of this token: | eval s=case("$sRange$"=="all", "segment=\"All\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)") This basic version, to be used directly inside a query, and this escaped version | eval s_escaped=case("$sRange$"=="all", "segment=\\\"All\\\"", "$sRange$"=="custom", "$ss$", 1==1, "( s=$sRange$)") To be used inside a $value$ token that was itself contained inside a string (" do some stuff on $value$ ") Not sure if it's clear but I was confused in the first place because of the different way I used the $s$ token (either inside or outside a string) ... View more

So I have finally solved this problem, but I had to add more event logic client side. I have added an event that fire after 5minutes of inactivity, and it is collected in the same index. So now basically what I do is a (somewhat complex) search that just takes only into account the session which has this event in the hour the search is currently running on. This way I can't get duplicates, and I don't have to agregates sessions that spans over several hours, because I am running the search on something like -24h, and join only with the ones that have the endSession event in the hour I am looking for. Running this every hours gives the real session length. final search looks like this: index=XXX "some random filters" action=endSession | eventstats max(_time) as maxTime by session userId | join userId [search index=XXX earliest=-24h | stats min(_time) as minTimeby session] | eval duration=maxTime-minTime | stats avg(duration) Thanks very much for the help! ... View more

It is usable, and officially released. You'll find some documentation and examples under the Module Reference section. It honestly just slipped my mind to enable it in the Editor and I'm sorry about that. I will add it to the Editor in the next release. Thanks very much for letting me know. ... View more