I would run with the following : index="bro" earliest=0 latest=now() _indextime > 1539343843 _indextime <= 1539343963 Since the time picker cannot be configured to run against a different field you have to search all of time and then filter based on the _indextime you want to see, sadly it is not fast if your index is big. _index_earliest and _index_latest do work but since you don't really see the index time it becomes difficult to validate your search results are accurate. This is what I normally do to see that : <search> | eval _time=_indextime This will cause your event timeline to show the events by _indextime so that you can validate the results easier. My index has lots of overlapping equivalent timestamps and I need to pull the latest values by _indextime so I often end up doing this : <search> | eval orig_time=_time,_time=_indextime | stats latest(stuff) | eval _time=orig_time | timechart <stuff> I'm not sure exactly what your data looks like but that helps me get the latest indexed values regardless of the _time of the event (slow... but it works). ... View more

I think my appsCA.pem got messed up. I copied it from another instance and was able to get this to function without any weird config or root/intermediate changes. ... View more

*** Edited for a better way than what I originally posted (oops, still learning trellis myself) *** Make today and yesterday their own fields for aggregation : | eval today = if(_time >= relative_time(now(),"@d"), value,"") | eval yesterday=if(_time <=relative_time(now(),"@d"),value,"") Add the following after your marker eval to adjust today's time backwards a day : | eval _time=if( _time>=relative_time(now(),"@d"),relative_time(_time,"-1d"),_time) Change your timechart to : | timechart avg(today) as today avg(yesterday) as yesterday by db Ensure your trellis split by is set to db Hope it helps. ... View more

I guess to further answer your questions, if the app does not have an splunk apps ID it is not a public app and will not have public information that people will allow people to answer questions. Try searching the app directory for a splunk apps ID. grep -r "apps.splunk.com/app/" $home/etc/apps/ ... View more

Thanks for the reply. I've tried this order (what I had when I posted) : ===OOTB SPLUNK CERTS (x3)=== ===MY ROOT=== ===MY INTERMEDIATE=== ===MY SERVER=== and this order (based on your post, in case the order matters) : ===OOTB SPLUNK CERTS (x3)=== ===MY SERVER=== ===MY INTERMEDIATE=== ===MY ROOT=== So far neither order corrects my issue. I do not have support (yet). ... View more

I am having this exact same problem but the suggested resolution did not correct it. Any other suggestions? ... View more

I could still use some advice if anyone has any. I figured this would be a common task. Mayhaps I misjudged the scenario. ... View more