Can you work within the time windows that ITSI provide? Will make things easier to understand.   What i think you are hitting is that the latest time bucket created by span will be partial.  Compare with the timechart switch partial=f If you want to solve it using time modifiers you might need to use the snap-to function instead of now() https://docs.splunk.com/Documentation/SCS/current/Search/Specifyrelativetime#3._Specify_a_snap-to_time_unit ... View more

Hi Arun. This might be a good starting point. https://dev.splunk.com/enterprise/docs/python/sdk-python/examplespython/ For conf files https://dev.splunk.com/enterprise/docs/python/sdk-python/examplespython/commandline#Work-with-Splunk-configuration-files ... View more

An answer that is loosely coupled. One reason can be that the search you are executing is a realtime search. So change the time that you are using from realtime to something static ... View more

Thanks for writing this up. Not only did it fix my problem, but I also learnt nice tricks and workflow. ... View more

Yet another way of making the change surviving reboots. Tested on Ubuntu Server 16.04.2 It uses systemctl to create a service that is run once every boot. Source: https://blacksaildivision.com/how-to-disable-transparent-huge-pages-on-centos Check if THP is enabled, as per above cat /sys/kernel/mm/transparent_hugepage/enabled cat /sys/kernel/mm/transparent_hugepage/defrag If [always] is within brackets it is enabled Create the disable-thp.service file sudo nano /etc/systemd/system/disable-thp.service Paste the following and then save the file: [Unit] Description=Disable Transparent Huge Pages (THP) [Service] Type=simple ExecStart=/bin/sh -c "echo 'never' > /sys/kernel/mm/transparent_hugepage/enabled && echo 'never' > /sys/kernel/mm/transparent_hugepage/defrag" [Install] WantedBy=multi-user.target Reload the systemd daemon sudo systemctl daemon-reload Start the service script sudo systemctl start disable-thp Enable the service to start at boot sudo systemctl enable disable-thp Check that THP is now disabled cat /sys/kernel/mm/transparent_hugepage/enabled cat /sys/kernel/mm/transparent_hugepage/defrag If [never] is within brackets it is now disabled ... View more