@sistemistiposta  We upgraded the storage engine on both our test instance and our production instance, along with the update to 8.2.5.   Only the production environment is exhibiting the symptom, however. ... View more

Hello @sistemistiposta, Yes, we completed that update immediately following the update to 8.2.5.  That is interesting...   It also seems the issue may exist beyond transforming commands as I have seen it on a simple table command.  I am also waiting eagerly on a response. ... View more

Hello @sistemistiposta, It is not a permanent solution for me either, and I have a support ticket opened with Splunk.  I will let you know what i find out.  I was mainly curious if we were experiencing the same problem. ... View more

I'm curious if you have a resolution yet? I recently came across a different, but similar issue and it was resolved when I added  "| dedup _raw" to my code.  I am still uncertain why it made a difference though. Failed: index=myindex eventName=myevent hostName=myhostname | timechart limit=0 span=1h avg(value) as value by eventType | table... Success: index=myindex eventName=myevent hostName=myhostname | dedup _raw | timechart limit=0 span=1h avg(value) as value by eventType | table... ... View more

Can someone please translate the <em> portions of this syntax from @yannK: id | eval mytime=<em>time | transaction id startswith="start" endswith="stop" | eval transactionid=id./<em>time | stats min(mytime) AS start max(mytime) AS stop values(id) AS id values(duration) AS duration by transactionid | eval mytimeconcat="1</em>".start." -1</em>".stop | eval mytimemv=split(mytimeconcat," ") | mvexpand mytimemv | rex field=mytimemv "(?(1|-1))_(?<_time>\d+)" | table _time id counter | sort _time | bucket _time span=5m | makecontinuous _time span=5m | streamstats sum(counter) AS concurrent_counter | table _time concurrent_counter ... View more

Base Search: index=ftgv2 sourcetype=FTGTVon* OR sourcetype=FTGTVoff* | transaction terminalAddress startswith=(eventName=FTGTVOff) endswith=(eventName=FTGTVOn) I am getting 2 events, one for TVOn and one for TVOff. They record the specific event and time by an identification number (terminalAddress). x axis would be time and y would be 1 for ON and 0 for OFF. Does that make sense? ... View more