Sure. Just add this to your currently working search. Duration is right now showing in secs, so we'll convert it to minutes, then bin it in 5 min buckets and then a stats command. your current search | eval Duration=round(Duration/60) | bin span=5 Duration | stats count by Duration ... View more

Just add an appropriately placed | bin span=1d _time and then add _time to the BY clause of your stats command. ... View more

If the new instance is also Splunk managed cloud instance, raise ticket Splunk support to get them migrated copied over. ... View more

Hey You can build a macro if this is something which is repetitive and you want to perform for every search. Refer below doc to build a macro. http://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Definesearchmacros Build a macro with the following query index=<your_index> NOT host IN (dx*,idx-i-,sh-i-,c0m1-i-*) let me know if this helps! ... View more

Try like this Search | rex field=_raw ".*renderTime.*connect.send.ms.(?.\w+)." | fields + host + AccountID | stats count by host, AccountID | xyseries AccountID host count | addtotals | table AccountID Total * ... View more

This works perfectly, Thank you! I added a field for the total number of requests sent by each host using "addtotal" . The issue is the total is the last column in the table but I want it to be the second column. I have tried using fields and table to rearrange the columns but does not seem to display the correct count. ... View more

This worked flawlessly! Thank You ... View more

Hi kaphie2002, you could pass in drilldown one or more tokens (e.g. Account) and then create your search in the secondary dashbord filtering for the maximum value, something like this in the secondary dashboard secondary_search Account=$account$ | rex field=_index ".payload number.(?.)completed.in\s(?.\d+)ms(?.\w+)" | eval TimeSec=round(ProcessingTime/1000,0) | stats count(PayloadID) as Payloads avg(TimeSec) as "AvgSec" max(TimeSec) as "Max Sec" BY Account | where Payloads > 1000 | sort "Max Sec" desc | head 1 | eval "AvgSec"=round(AvgSec, 1) | rename AvgSec as "Avg Sec" if you want more information, add other fields as values in the stats command. Bye. Giuseppe ... View more