Hello Richgalloway, thank you for feedback. I´ve managed to set my time window with Uptime results. Now I got issue using my span so that I could see _time and Uptime in seconds in one row only. This I would like to achieve by setting Time picker to last 3 days and I set my span to 72 hours so that Im having one row with all the results. | bin span=72h _time My most oldest time should be then always 3 days backwards.  But when I do this my results display also time which is outside of 3 days (see attachement). My oldest results should have end 18.11.24 in the morning but instead it also shows results for 17.11.24. In this case instead of one row I will have 2 rows which will crash my search idea as I need to have one row with the results only.  Why is that can you suggest ? How exactly does span function work ? ... View more

| bin span=3h _time | stats max(uptime) AS Uptime BY _time, component_hostname | where Uptime=0 ... View more

Thank you for feedback but yet again this will return uptimes regardless length (0,  1 or more). If I use where Uptime=0 it shows me uptime lengths taking 0 but it does not necessarily mean there are no 1, 2 or any different lengths while span.    I need my result to return those component_hostnames which had no different length except of 0 nothing else (no 1 or 2 or any different).  This is how I would know component is UP or DOWN during my span.  ... View more

Hello, see table below please. There are results for components A, B and C: _time component_hostname uptime 2024-11-11 15:00 Host A 0.00000 1.00000 5.00000 2024-11-11 15:00 Host B 0.00000 1.00000 2024-11-11 15:00 Host C 0.00000   If I apply where uptime=0 my results will look following: _time component_hostname uptime 2024-11-11 15:00 Host A 0.00000 2024-11-11 15:00 Host B 0.00000 2024-11-11 15:00 Host C 0.00000   But this is not what I need because component A was also showing uptime during my span 1.00000 and 5.00000. Same applies for component B as it was showing uptime 0.00000 and 1.00000. Which means that components A and B where uptime during my span and that is ok. But I´m interested only for components which during the span where showing no other value then 0 e.g. component C. Like this I know that components A and B are responding during my span but component C not responding because its always 0.   ... View more

Hello ITW, thank you for reply. Where Uptime=0 won´t resolve it because during 1 day span some component_hostnames been uptime for few seconds e.g. 1.0000 or 5.0000. This means it can´t be counted as permanent downtime.  My query should be looking only for component_hostnames  which had no different Uptime except of 0 in span of 1 day. Stives   ... View more

Hello, I´ve adjusted my query following: | bin span=3h _time | stats values(uptime) AS Uptime BY _time, component_hostname Like this I will get all Uptimes listed in a span of 3hours by component_hostname. See table _time component_hostname uptime 2024-11-11 15:00 router   0.00000 1.00000 5.00000 You can see there are results which do include different uptimes e.g. 0..., 1.... or 5.... Now I would like to create an Alert so that it will display only component_hostname which had no different uptime expect of 0 for 1 day. Thank you ... View more

Hi, I know it's bit confusing but when I run my query field Uptime has value 0,00 by _time. It does not matter how many decimals after 0.  ... View more

Hi ITWhisperer, downtime represents every value starting with 0,00 do matter how many decimals. BR ... View more

Hi Guiseppe, thank you. Finally managed to adjust permissions. The problem was that the user was not properly defined inside of Search/Reporting app. permission. Now it´s fixed. Thank you. BR Stives  ... View more

Hi Giuseppe, thank you for feedback I appreciate. In your previous message you mention It isn't a role problem, but a knowledge objects sharing permissions problem. What exactly you mean by that?  BR ... View more

Hi Giuseppe, thank you for feedback. This is exactly the problem user who created dashboard can´t edit permissions and on the other side I´m not able see his dashboard as it´s set to Private so we not able move forward like this. Thanks ... View more

Hi gcusello, thank you for reply and support. You where right there where 2 versions of app deployed in different directory. How should I proceed to safelly remove unwanted application from Splunk deployed on cloud? Thank you? BR ... View more

Thank you so much PickleRick. It works for me well. I was able isolate 3 consecutive results. I appreciate ... View more

Thank you PickleRick, I already got streamstats in my search query but got more results not only consecutive and I want isolate 3 consecutive results (see end of queary): | eval Description=case(RML<104.008, "0", RML>108.425, "1", RML>=104.008, "OK", RML<=108.425, "OK") | eval Warning=case(Description==0, "LevelBreach", Description==1, "LevelBreach") | table LWL UWL RML | eval CR=if(RML<UWL,"0",if(RML>LWL,"1","0")) | accum CR AS ACC | streamstats window=3 reset_after="count=3" count ... View more

Hello thank you. Splunk AR app is installed on my iPhone 12 mini. Before I could register device but not the case anymore. Could this be a app. bug ?  ... View more

Hello I´ve upgraded DB connect app. from version 3.** to 3.15 not long time ago but I could configure it without any issues. I´ve start to receive this error only recently. I´m also attaching port related message. I was also trying to downgrade DB connect app. according the instructions but when I change from DONE to PENDING I see no difference it´s still 3.15.0. ... View more

Version 3.15.0 ... View more

Hi @scelikok  thanks for reply, my feedback below: / I tried to restart services no change. / if I run Upgrade readiness scan for jQuery scan its ok..but for Python scan 2 public apps failing one of them DB connect app. Thanks in advance.   ... View more