Exact same query when run via search app returns 0 Statistics but shows correct stats when run via cloud monitoring app. I am not using any macros here. What could be the issue here? Query [Time range: Yesterday]: (search_id!="rsa_" action=search host= host=sh*.splunkcloud.com index=audit sourcetype=audittrail NOT user=cmon_user NOT user=internal_monitoring NOT user=ops_admin) | eval user=if((user == "n/a"),null(),user), search_type=case(match(search_id,"^SummaryDirector"),"summarization",match(savedsearch_name,"^ACCELERATE"),"acceleration",match(search_id,"^((rt_)?scheduler_|alertsmanager_)"),"scheduled",match(search_id,"\d{10}\.\d+(_[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})?$"),"ad hoc",true(),"other"), search=if((isnull(savedsearch_name) OR (savedsearch_name == "")),search,savedsearch_name) | stats min(_time) as _time, values(user) as user, max(total_run_time) as total_run_time, first(search) as search, first(search_type) as search_type, first(apiStartTime) as apiStartTime, first(apiEndTime) as apiEndTime by search_id, host | search (host=* search="" user="") | where ((search_type = "scheduled") AND isnotnull(search)) | eval earliest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiStartTime,"%ZERO_TIME%"),"-",true(),apiStartTime), latest=case((like(apiStartTime,"%ZERO_TIME%") AND like(apiEndTime,"%ZERO_TIME%")),"all time",like(apiEndTime,"%ZERO_TIME%"),"-",true(),apiEndTime), _time=strftime('_time',"%m/%d/%Y %H:%M:%S %z") | stats max(total_run_time) as total_run_time by search, _time, earliest, latest, search_type, user, host, search_id | where (total_run_time >= 0) | sort - total_run_time | fields search, total_run_time, _time, earliest, latest, search_type, user | eventstats count max(total_run_time) as max_run_time sum(total_run_time) as total_run_time_2 by search user | sort 0 - total_run_time | dedup search user | fields search, max_run_time, _time, , earliest, latest, search_type, user, total_run_time_2 count | rename _time as "Search Start", earliest as "Earliest Time", host as Host, latest as "Latest Time", search as "Report/Alert Name", search_id as SID, search_type as Type, max_run_time as "Max Runtime (seconds)", total_run_time_2 as "Total Runtime (seconds)", user as User, count as "Execution Count" | head Screenshots: ... View more

I could not find this property under $SPLUNK_HOME$/system/default/inputs.conf time_before_close = * The amount of time, in seconds, that the file monitor must wait for modifications before closing a file after reaching an End-of-File (EOF) marker. * Tells the input not to close files that have been updated in the past 'time_before_close' seconds. * Default: 3. ... View more