Thanks for the query. In addition, you can give a note at the end for the fields to be filled in by the user, to be more helpful. index=index_name host=host_name sourcetype=st_name| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | table host, indextime | tail 1 Note: Fill in "index_name, host_name and st_name" fields based on the requirement ... View more

HI, I find the same error with some of my users as well. how to resolve this issue? please help. ... View more