I adjusted your search to use the _internal index, you should be able to adjust the SPL to suit your use case. This is where I would use eventstats to create a new field on each even that had the max value, and then filter to just those. And if you have two time buckets that have the same, grab just the latest.   index=_internal | bucket _time span=1m | stats count by sourcetype _time | eventstats max(count) as maxcount by sourcetype ```Get the max count for all buckets by sourcetype``` | where maxcount=count ```Filter down to where the maxcount is the count``` | stats latest(_time) AS _time, latest(count) by sourcetype ```Get just the latest time for that sourcetype, and the count``` ... View more

I meant to link https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Admin/PrivateApps ... View more

I am on Classic and was able to modify a app.conf in private app that you can deploy. See https://dev.splunk.com/enterprise/docs/releaseapps/manageprivatecloud/ for some more info as well. ... View more

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Appconf#.5Bui.5D suggests you need to add an entry to your app.conf file in the ui stanza of supported_themes. [ui] supported_themes=enterprise,dark   ... View more

I would use outputlookup after the dbxquery, on a schedule, and then use lookup against that csv file. ... View more

This is because the version of Python running inside Python for Scientific Computing does not have SSL support. I had to modify binding.py with a try catch block around the import ssl, set a property that it has SSL support, and places where it calls SSL, wrap it in an condition. 30c30,34 < import ssl --- > try: > import ssl > hasssl = True > except ImportError: > hasssl = False 548c552,555 < sock = ssl.wrap_socket(sock) --- > if hasssl: > sock = ssl.wrap_socket(sock) > else: > raise ImportError('No SSL library found') 1331,1337c1338,1347 < if key_file is not None: kwargs['key_file'] = key_file < if cert_file is not None: kwargs['cert_file'] = cert_file < < # If running Python 2.7.9+, disable SSL certificate validation < if sys.version_info >= (2,7,9) and key_file is None and cert_file is None: < kwargs['context'] = ssl._create_unverified_context() < return httplib.HTTPSConnection(host, port, **kwargs) --- > if hasssl: > if key_file is not None: kwargs['key_file'] = key_file > if cert_file is not None: kwargs['cert_file'] = cert_file > > # If running Python 2.7.9+, disable SSL certificate validation > if sys.version_info >= (2,7,9) and key_file is None and cert_file is None: > kwargs['context'] = ssl._create_unverified_context() > return httplib.HTTPSConnection(host, port, **kwargs) > else: > raise ImportError('No SSL library found') ... View more

I also have a similar situation, and created the following search to accomplish what I need: | stats values(job) AS job, max(_time) AS maxTime, min(_time) AS minTime by jobid | streamstats current=f window=1 global=f last(maxTime) as last_maxTime by job | eval _time=minTime | table _time, job, jobid, minTime, maxTime, last_maxTime | eval overlapped=if(last_maxTime>=minTime,1,0) | where overlapped=1 In this case, I use stats, instead of transaction, to get the start and end time of the event (based off jobid, which is a unique id for each event). Then I do a streamstats to get the previous end time to compare to my start time, if the end time of the previous event is >= the current start time, then I set a flag called overlapped, and filter to those. This does not get a count of the number of events in that event time range, but works for my purposes. ... View more

After beating my head against a wall on this, I've found this is not currently possible for lookups. It either screws up the query wrapping Splunk does, or when that is disabled, it attaches a second where clause, which makes it invalid (since it is not AND <condition> ), but WHERE <this> WHERE <that> . The more problematic hurdle is that Splunk will batch up the queries and provide them into an IN clause. For one of my use cases I'm getting around this by providing a materialized view, so the query is still performing well, and the query logic is housed in that view. My second use case won't easily be supported, where I have a user defined function that I need to pass the parameter to. This, I'll have to figure something else out. Both of these work fine with dbxquery , but that is harder to use as a lookup like this. ... View more

Same result as well. Also for fun I swapped the table and mvexpand . Still the same. ... View more

I forgot to mention I tried that as well, same results. ... View more