After doing some more reading on yield , it turns out that putting yield into a sub-function turns that function into a generator and, in order to get results out of it, one has to iterate over that generator: def drain( self ): recs = self.vdict.values() for rec in sorted( recs, key=operator.itemgetter( K_TIME ) ): yield rec self.vdict.clear() Then to call it: for rec in self.drain(): yield rec In Python >= 3.3, one can instead do: yield from self.drain() but Splunk currently ships with Python 2.7.11. ... View more

Macro is the best way. ... View more

Try this run anywhere command (for your data, just use the portion starting with | streamstats). | gentimes start=-1 increment=5m | eval vehicle_id=random()%10 |eval stop_id=random()%10 | eval _time=starttime |streamstats global=f window=2 range(_time) AS wait by stop_id | eval wait=wait/60 | chart avg(wait) max(wait) by stop_id And for a timechart: | gentimes start=-1 increment=5m | eval vehicle_id=random()%10 |eval stop_id=random()%10 | eval _time=starttime |streamstats global=f window=2 range(_time) AS wait by stop_id | eval wait=wait/60 | timechart avg(wait) max(wait) by stop_id ... View more