I had a similar issue where I needed to find spans of time where the logs I was looking for dropped to 0 to represent a potential outage. I used the `timechart` like what was described but then used `untable` to get it back into a usable format for my purposes. `Base search | timechart count by clientip useother=f limit=0 | untable _time clineip count`  Then I could further stats to count my iterations of "0" values for a threshold. ` <BASE SEARCH> | timechart count by clientip useother=f limit=0 | untable _time clientip count | sort 0 clientip _time | eval no_events=if(count=0,1,0) | streamstats sum(no_events) as consecutive values(no_events) by clientip reset_before=count=1 | stats max(consecutive) as consecutive_missed by clientip | where consecutive_missed>=10 ```Adjust Based on Alert Period, e.g, 24h set to 3; 1hr set to 10; ``` ` ... View more

I also took a similar approach based on your answer. I used a scripted input to download the csv I needed and pull it into an index and then your sourcetype for formatting.    ../app/bin/download_csv.sh Ensure that this file has the right permissions for the splunkd user, I also ensured that it was executable.    #!/bin/bash URL="https://www.somesite.com/myfile.csv" curl -k -s $URL     ../app/local/inputs.conf   [script://./bin/download_csv.sh] disabled = false interval = * * * * * index = myindex sourcetype = mytype_csv     ../app/local/props.conf   [mytype_csv] DATETIME_CONFIG=CURRENT NO_BINARY_CHECK=true INDEXED_EXTRACTIONS=CSV HEADER_FIELD_LINE_NUMBER=1   Then I'll update the csv in a similar fashion to your own with the search.  ... View more

@MarkusM     Did you ever find a fix for this? I ran into the same thing just recently and when tinkering with the search I found that the lookups were causing it, but if the search is autogenerated I don't know how to fix it.  ... View more

Ran into this yesterday and this is exactly what I needed. Thank you.  ... View more

Playing around with some results it doesn't seem to affect anything, but I was also concerned about the ."-01" in this line from your original post, the resulting output of the strftime() function wouldn't fit the format.  You'd end up with something like 2021-03-22-01. | eval start_date=strptime(strftime(start_date1,"%Y-%m-%d")."-01","%Y-%m-%d")   ... View more

I had a couple questions in your start date format, what does the "f" at the end of the date format mean?  Can you provide a sample value of "start_date1" from just after mvexpand "start_date1" but before you perform any evals on it?  ... View more

To expand on some of the other answers. I ran into errors with tstats when trying to go back more than a few days on the time picker. I figured this was due to memory required for the events it was pulling back. I went with the eventcount method I saw in other posts. I was working on something similar, but found that the search didn't list empty indexes. To incorporate empty indexes I used:    | eventcount summarize=false index=* | search NOT index IN ( <indexes you don't want to include> ) | dedup index | fields index | map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\"" | fields index sourcetype | append [| eventcount summarize=false index=* | search NOT index IN ( <indexes you don't want to include> ) | dedup index | fields index] | fillnull value="No Known SourceTypes" | stats count as mc values(sourcetype) as sourcetype by index | stats count values(mc) as mc by index sourcetype | eval sourcetype = if(sourcetype=="No Known SourceTypes" AND mc>1, NULL,sourcetype) | dedup index sourcetype | fields index sourcetype   If you want to group the results by index you can append a stats command to the search like:   <base search> | stats values(sourcetype) as sourcetype by index     ... View more

To expand on this. I had an issue where if I did this empty indexes wouldn't show in my results. I used the following to work around that.  | eventcount summarize=false index=* | search NOT index IN ( <indexes you don't want to include> ) | dedup index | fields index | map maxsearches=100 search="|metadata type=sourcetypes index=\"$index$\" | eval index=\"$index$\"" | fields index sourcetype | append [| eventcount summarize=false index=* | search NOT index IN ( <indexes you don't want to include> ) | dedup index | fields index] | fillnull value="No Known SourceTypes" | stats count as mc values(sourcetype) as sourcetype by index | stats count values(mc) as mc by index sourcetype | eval sourcetype = if(sourcetype=="No Known SourceTypes" AND mc>1, NULL,sourcetype) | dedup index sourcetype | fields index sourcetype ... View more

This search worked better for me over the other tstats searches. The tstats search would generate errors over too long a time.  ... View more