Sure @EdwinOssa , no problems.. i appreciate your questions and wish you best of luck for your splunk learnings .. (sorry for the late reply) 1) the " chart avg(percent)" is missing a "by" field.. generally "chart avg(time_spent) by referer_domain" Please check the search reference document for chart command syntax and examples: https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Chart#Basic_examples 2) the time_spent field is not available on the logs i think(i am not sure of the last number that appears on these logs.. that may be the time_spent, but i am not sure) 3) referer_domain is just 4 on these logs. so something missing on your requirement.  Please let us know more details.  ... View more

@HattrickNZ if you are having a 9 digit epoch means, thats timestamp value is a very old timestamp(before Sun Sep 9 01:46:39 2001 UTC)(but ideally it should work fine, something wrong.. pls provide us your search query) Question Will UNIX's epoch time change from 9 to 10 digits affect Gentran? (SCI8237) Answer No. epoch time is how time is kept track of internally in UNIX. It's seconds, counting upward from January 1st, 1970. This number hit 1 million (1,000,000) in March of 1973, and will hit one billion (1,000,000,000) on Sun Sep 9 01:46:39 2001 UTC. This change, from a number which can be represented in 9 decimal digits to a 10-digit number, is not expected to cause any problems for UNIX systems. The reason is that this value is not stored as decimal digits. Instead, it is stored as an integer value (a 32-bit binary variable) which can be used safely until the year 2038, when the epoch date goes back to 0. The uses in UNIX of a decimal format for the "seconds time" value are primarily in portable file formats, such as tar, cpio, and ar. These formats have always supported at least eleven decimal (or octal in some cases) digits, easily handling UNIX's one-billionth "birthday".   https://www.ibm.com/support/pages/will-unixs-epoch-time-change-9-10-digits-affect-gentran-sci8237-sterling-gentranserver-unix   ... View more

For reference of the new learners of crontab,...  Minute ---- hour ------ day of month(1-31) ---- month(1-12) ---- day of week(0-6) 0 0 1 1,4,7,10 * min----hr----day--- Jan,Apr,Jul,Oct---anydayOftheWeek     ... View more