Hello Splunkers, I want your help to understand different responses of stats and chart command output. In First output with STATS command, date and time showing correctly in the last column. index=index1*|..... | search issueType = "Bug" AND (Status = "In QA" OR Status = "In Dev") AND (priority = P1 OR priority = P2 OR priority= P3) AND (key = "CORE-26985" OR key = "CORE-37789") | stats min(update) as qaStatusDateMin by key,Status But when I use chart command then only year is showing instead of date and time under newly generated columns named "In QA" and "In Dev" | fillnull value="None" labels | search issueType = "Bug" AND (Status = "In QA" OR Status = "In Dev") AND (priority = P1 OR priority = P2 OR priority= P3) AND (key = "CORE-26985" OR key = "CORE-37789") | chart min(update) as qaStatusDateMin by key,Status I hope, I have explained my question here in detail. Please help me to understand the logic behind this output response. Your help will be appreciated! ... View more

Hello everyone, I need your help in date\time comparison in table field itself. Lets suppose, any key value goes into status as "In QA" after completing Status as "In Dev" with some date\time and then again due to some issues which will be identified later on, same key value status changed again into 'In QA" Status. I am looking for the date\time when Status changed into "In Dev" for the second time. I have attached a screenshot on the below URL. https://ibb.co/BPnrqXL Thank you all for any help in advance! ... View more