- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You could create a summary index based on a report of the events in the first index and then create a chart based on the values in the summary index. If your summary index needs particular processing that is not possible with standard SPL, you could write your own custom command (in python) and feed the events from the first index to that before writing the results to the summary index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your feedback @ITWhisperer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You could create a summary index based on a report of the events in the first index and then create a chart based on the values in the summary index. If your summary index needs particular processing that is not possible with standard SPL, you could write your own custom command (in python) and feed the events from the first index to that before writing the results to the summary index.
