I have the below search in one of my dashboards. I have a mutiselect field in my dashboard: one for picking the start date/time and another for end date/time. When i select multiple date/time, I'm getting only results for last selected values, it's not coming for multiple times selected.
sourcetype=smapi $earliest$ $latest$ assetGroup=pdc1c dimeName="KeyEvent" status="OK" actionName="searchlegal" | table actionName transId response _time
The short answer is that earliest=
can only accommodate one value, and so can latest=
.
If you want to run multiple simultaneous searches for different time periods, then you are going to have to do a lot of custom code to make it happen (for example, setting up your searches using map
or multisearch
), not just straight-out-of-the-box multiselect for some time fields.
For example, see the final answer ( multisearch
) in this question
thank you @DalJeanis.... how can we be build the query dynamically...number of different time ranges will be different everytime.....sometimes we need to compare with 2 or more