If this is from the Splunk ServiceNow App, the _time is most likely coming in as LOCAL, and sys_created_on as GMT. On your dashboard you most likely want your time chart to also be LOCAL time. Accordingly, I would recommend: | rename COMMENT AS "equate _time TO sys_created_on_Local which can be converted FROM sys_created_on_GMT " | eval _time=strptime((sys_created_on_GMT." UTC"),"%Y-%m-%d %T %Z") | timechart count ... etc. ... View more

I have successfully used my two suggestions above (i.e., "table" or put the code in a macro that contains the "fields -" command). Additionally, a real hack I sometimes use is a "focused" macro--e.g., FieldsMinus4 defined as: fields - $field1$, $field2$, $field3$, $field4$ Which I implement as: | makeresults | eval aField1=123 | eval aField2=456 | eval aField3=789 | `FieldsMinus4(aField1,a,b,c)` This takes advantage of the fields command working whether or not the field(s) exist that are passed as arguments. Thus I populate the 4 arguments using a, b, c, to make sure all 4 are there. This works for me for the many cases where there are less than 5 fields I need to remove. Regards. ... View more

It cannot be. You do fields _time trackingStr and then you do BY number and because you dropped the number field, your search will have no events from that point on. You really need to get your story straight on this. Every time you add a requirement, I have addressed it only to see you add another requirement. Now you have several different answers that have evolved way into the weeds and still nothing that works. Take a step back and add a comment to your Question that completely restated your actual requirements. Ideally this will include both sample events and a mockup of the desired outcome (with sample events that are well-constructed to demonstrate the shortfalls of the some of the partial solutions). At this point, I cannot really continue without a full reset. ... View more

Splunk even adds a little symbol to the link to indicate that it opens in a new tab. ... View more

I downvoted this post because the other answer on this page is more correct ... View more

My statement is specific to the limitation on using macros in the argument list of a macro (e.g., passing a macro in an argument to another macro). That is not allowed. I too make liberal use of macros inside of the definitions (expansion) of other macros. ... View more

turned out to be a configuration issue with my mail server. The Alert did fire with Number or Results > 1. Thanks ... View more

Here is the answer, finally!! Only "earliest" and "latest" should be used without the token name prefix....sigh. And, this user shows success with the single quote, not the $. https://answers.splunk.com/answers/391250/why-does-timepicker-have-oldlag-context-data-durin.html ... View more

Very nice! Sooo, how would I do this with a "stats" command using "by _time". Ths solution is working perfectly on my implementations, but now I have one grouped by time. Maybe I need to run it through a timechart instead...hmmm Thank you! ... View more

The portions are just underscores. The search would be as follows with the replaced and fixing the counter field missing: id | eval mytime=time | transaction id startswith="start" endswith="stop" | eval transactionid=id._time | stats min(mytime) AS start max(mytime) AS stop values(id) AS id values(duration) AS duration by transactionid | eval mytimeconcat="1".start." -1_".stop | eval mytimemv=split(mytimeconcat," ") | mvexpand mytimemv | rex field=mytimemv "(?(1|-1))_(?<_time>\d+)" | table _time id counter | sort _time | bucket _time span=5m | makecontinuous _time span=5m | streamstats sum(counter) AS concurrent_counter | table _time concurrent_counter Cheers!!! ... View more