Hi, One of use case giving below error while sending email to recipients. The use case configured to run every 20 mins and the use case alert trigger action is send alert and notable.  we cannot see the  results in notable index and we are not receiving the email. If we ran the use case manually we can see the results. I have checked in python logs, nothing found about use case Error message 08-17-2023 03:04:34.681 +0000 ERROR ScriptRunner [6973 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://XXxxx-splunk.com/app/SplunkEnterpriseSecuritySuite/@go?sid=scheduler_c29jX2VzX3JlcG9ydA__SplunkEnterpriseSecuritySuite__RMD5851862a85f91df65_at_1692241200_11388_A08142CF-D931-4BE1-ADEA-3D2962FFE6D6" "ssname=xxxxxx- xxxx-xx-xxx -  - Rule" "graceful=True" "trigger_time=1692241474" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_c29jX2VzX3JlcG9ydA__SplunkEnterpriseSecuritySuite__"': _csv.Error: line contains NUL External search command 'sendemail' returned error code 1. ... View more

Hi  For example  Using below query i can see  when we received the last log to splunk, based on that if I search for events it's not showing  Using below spl i can see when we we received latest events with below combination with 30 days timerange   |Tstats latest(_time) as _time where index=abc sourcetype="Cisco devises" host=1234 by index source sourcetype host.     But if I search same spl for seeing events not showing the results --same timerange index=abc sourcetype="Cisco devises" host=1234      ... View more

I have a field like report In the field it's showing t or s Events like service name report One. T Two. ` F I need t values only ... View more

how to calculate starttime and Endtime duration |08-feb-2019 01:30:18|08-feb-2019 01:30:28 ... View more