Try this: |tstats avg(tcp_KBps) AS "KBps" avg(tcp_eps) AS "Eps" WHERE index=_internal AND sourcetype="splunkd" AND connectionType IN("cooked", "cookedSSL") AND hostname="*" BY hostname _time [| makeresults count=2 | streamstats count | eval _time = _time - (100 * count) | timechart count | rename _* AS INV_* | eval search = "span=" . INV_span . "s" ] | rename hostname AS host | timechart limit=0 useother=f first(KBps) AS KBps first(Eps) AS Eps BY host ... View more

Thanks Adam ... View more

Search command primer: http://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Usethesearchcommand Search tutorial: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchTutorial/WelcometotheSearchTutorial ... View more

Have you tried just using curl? curl -ku 'admin':'changeme' https://myserver:8089/servicesNS/admin/search/search/jobs/export -d search="|inputcsv foo.csv | blah" -d output_mode=csv ... View more

While trying to solve this issue I found all sorts of stuff about swapping java versions and performing custom builds of the SDK. This was the solution that worked for me. Thank you Greg! ... View more

And a macro method is documented here: http://docs.splunk.com/Documentation/Splunk/latest/Search/Addcommentstosearches ... View more