That was bonkers hard to figure out. I took out some of the joins to make this clearer. * | rex field=source ".*/(?<my_int>\d+)_(?<my_max>\d+)_.*_(?<my_system>\w+).txt" | eval intsys = my_int."_".my_system The next 2 lines set up a running count over continuous days | timechart limit=0 span=1d count by intsys | untable _time intsys value Now we figure out the cumulative totals by day | streamstats sum(value) as total by intsys Here's the tricky bit. For every given int_sys, find the range of time the series is valid | eventstats max(eval(if(value > 0,_time,NULL))) as mxtime min(eval(if(value > 0,_time,NULL))) as mntime by intsys Discard values outside of the valid range | eval total=if(_time < mntime or _time > mxtime,NULL,total) Then plot it | xyseries _time,intsys,total | makecontinuous _time Before : ( reversed the direction, and reset the count for each integer/system ) After: ... View more

You probably dont. You'd use haproxy with session affinity. If you need the SSL to terminate at the splunk servers, and there's no NAT involved you can stick on the source IP, otherwise look here Without session affinity, the next (probably ajax) request would hit the other splunk instance and be rejected for not being logged in ... View more

answer here Use the refresh attribute to set how frequently, in seconds, to refresh the dashboard. For example, <dashboard refresh="30"> sets the refresh rate to 30 seconds. ... View more

Lots of metrics in the same event require you to know what the field names are if you're going to perform stats on them. The workaround is to use untable. Whenever you think "How the heck .." - untable is usually the answer. xyseries is its inverse. I have data similar to yours. every 2 minute I have a feed of disk utilization that looks like : Event 1: sda=0.0;sda1=0.0;sda2=0.0 Event 2: sda=10.3;sda1=1.0;sda2=9.3 Here's the search that only hits the index once, and works for arbitrarily named fields : The 1st "table" is where you include / filter the fields you are interested in - this allows far more flexibility than using wildcards in the stats commands. initial search | table _time sd* | untable _time field value | eval metric="raw" | appendpipe [ | stats avg(value) as data by field | eval metric="Average" ] | appendpipe [ | stats median(value) as data by field | eval metric="Median" ] | appendpipe [ | stats sparkline(avg(value)) as data by field | eval metric="Sparkline" ] | where metric !="raw" | xyseries metric field data result : You can save yourself a lot of headache by transposing the columns and rows initial search | table _time sd* | untable _time field value | chart avg(value) as Average median(value) as Median sparkline(avg(value)) as sparkline by field ... View more