You can use timechart 1) count all requests index=itsm | timechart span=1d count 2) if you want to unique count user index=itsm | timechart span=1d dc(user) as user
... View more
This is cause from TA_Microsoft-Sharepoint/README/inputs.conf.spec. You should rename inputs.conf.spec to other name, such as inputs.conf.spec.X then restart splunkd
... View more