What bin does is 'smoosh' , in this case, the time field so that all of the dates appear the same (essentially midnight of the day in question). I'm doing this because now you can run your query across a number of days - 7, 30, etc - and get the unique number of days a user might have logged in. To see this in action you could do something like ...| eval foo = _time | bin span=1d _foo | convert ctime(foo) | table _time foo Even though you've smooshed (quite a technical term I must say) the time field you still have individual login instances which allows you to also get a total count of logins per user & database. Sorting is simply a matter of picking which field you want and of course you can sort on multiple fields. Hopefully that helps a bit. ... View more

It appears to be executing... ... 2018-05-01 06:00:07.410 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' started 2018-05-01 06:00:07.411 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' stopping 2018-05-01 06:00:07.418 -0400 [QuartzScheduler_Worker-1] INFO org.easybatch.core.job.BatchJob - Job 'CubLoad_6am' finished with status: COMPLETED Can I see a record count of records that are or are not ingested? and if I can't can I manually execute the job? ... View more

Ah, thanks I was looking for that... ... View more

Just a follow up in case someone else runs into this.. removing the comment "--check for blank CLOB" fixed the issue. AND LENGTH(p."Value") > 0 --check for blank CLOB Adam, ... View more

Just a follow up in case someone else runs into this.. removing the comment "--check for blank CLOB" fixed the issue. AND LENGTH(p."Value") > 0 --check for blank CLOB Adam, ... View more

@adam_marx - I've moved your comments into the thread under the answer, to reduce confusion. If your problem has been solved, please accept the answer. Also, in general you can always feel free to upvote any answers you found particularly helpful or useful, whether or not you were the one who asked the question. ... View more

Many thanks for the additional insight and your expertise it will go a long way in getting me more involved with splunk and its many uses. Happy Thanksgiving to you and yours! Adam, ... View more