How to display the latest data instead of total data for last 7 days on dashboard panel

[aditsss]

Hi Everyone,

I have one requirement like below:

I have one dashboard which consists of different different panels like TimeOut,Failure,Success etc.

The dashboard is showing the count value for each panel like TimeOut= 2176, Failue = 51 like that.

By default its showing the data for yesterday . 

My requirement is when I select suppose last 7 days or last 30 days from the date drop-down.

Currently its displaying the total count of last 7 days if I select last 7 days. I want it should display the latest count not the total count .

Also I want to create another panel  which will display the trend for last 7 days if I select last 7 days.

So suppose I select last 7 days so one TimeOut panel should display the latest count not the total count of the last 7 days and another panel should show the trend timeout for the last 7 days.

Currently I have only one panel which is showing total while selecting last 7 days not the latest one. 

I want latest count should be displayed while selecting last 7 days or 30 days not the total count of last 7 days 30 days .whatever is selected.

Can someone guide me on this.

Below is my search query:

<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="abc" sourcetype=xyz Timeout $Org$ | stats count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>
</row>

Thanks in advance.

[ITWhisperer]

If I understand your requirement correctly, you just need to add a time element to your query

<query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time | stats count by _time</query>

You should get the count from the last day with a trendline/sparkline for your time period and a trend indicator for the last day 

[aditsss]

Hi ITWhisperer,

My requirement is like this:

I have one dashboard which consists of several panels like Failure,TimeOut etc.

The panels are showing count values like Timeout= 2161.

Now suppose when I select Date as September 11 from the date dropdown the TimeOut panel is displaying count value of TimeOut as 3,694 . when I select Date as September 10 from the date dropdown the TimeOut panel is displaying count value of Failure as 4337.

Now suppose I select date value from date dropdown as September 10 to September 11 its showing the count value for TimeOut as 8031. which is the total count of the two days 3694+4337. 

I want when I select two days from date dropdown say september 10 to september 11. It should show the latest count that of timeout that is of september 11.that is 3694 not the total count of the two days 8031 which its showing currently.

when I select 7 days it should show the latest Timeout count not the total count of 7 days on panel.

Can you guide me how can I achieve that.

Below is my xml code.

<form theme="dark">
<label> Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Org">
<label>Org Name</label>
<choice value="*">PROD</choice>
<choice value="KMGb">ATMS</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>
</row>
</form>

Thanks in advance

[ITWhisperer]

Hi @aditsss 

As I said, the query for the single needs to have a time component to the stats so that the query returns a range of values. Single will then display the latest of these (which is what I think you are after). Please try my earlier suggestion

<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time | stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

This is the important part of the query for single to be able to use the count from the last day and for it to have more than one result in order to work out a trend

<query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time | stats count by _time</query>

[aditsss]

Hi ITWhisperer,

I am able to see the latest count for timeout when I select date range as september 10 to september 11 in date dropdown that is 2 days so I am able to see 3694 which is timeout count value for september 11 not the total count.

But along with 3694 count value  I am able to see  one arrow (-> with 0% and one trend line coming down the value)

I only want 3694 count value to be displayed in this panel. Nothing else.

And I need to create another panel where I should show the trend line for last 2 days or last 7 days whatever value I have selected from date drop down.

In short I want two panels one will display the latest count and another should display the trend for the number of days I have selected.

As of now I have only one panel which was displaying the count.

Can you guide me on that.

Below is my xml :

<form theme="dark">
<label> Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Org">
<label>Org Name</label>
<choice value="*">PROD</choice>
<choice value="KMGb">ATMS</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time | stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>
</row>
</form>

[ITWhisperer]

So one panel is a simple single with no trend information - you were almost there at the start

<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
</single>
</panel>

Your second panel can just be a simple line chart 

<panel>
<chart>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time | stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
</chart>
</panel>

[aditsss]

Hi ITWhisperer,

I am able to show the  2nd panel trend correctly. But again First panel is showing the total count value for timeout not the latest one.

I want if I select last seven days from the date drop-down the 2nd panel should show the trend for last 7 days (which is showing correctly) and 1st panel should show the latest timeout count not the total of count of 7 days.(Its showing total of 7 days)

Can u guide me where I am going wrong with my first panel as its again showing total.

Below is my xml code:

<form theme="dark">
<label> Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="Org">
<label>Org Name</label>
<choice value="*">PROD</choice>
<choice value="KMGb">ATMS</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>
<panel>
<chart>
<title>TIMEOUT TREND</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</form>

[ITWhisperer]

@aditsss 

Please, please, please read what I suggested carefully!

You should have noticed that the first single panel has

<earliest>-1d@d</earliest>
<latest>@d</latest>

whereas you are insisting on leaving it as

<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>

 Do you not see the difference?

[aditsss]

Hi ITWhisperer,

Thanks for your Suggestion.

Just one issue is there with it. Rest all its working properly .

while showing time as below for the first panel. Its always showing latest timeout count even in the case where there is no data.

Suppose I select date range as Today or last 4 hours or last 15 minutes from Date/Time drop-down (Data is not there for these particular time periods). Then also its showing the data in timeout panel as 1209  which is the latest timeout data that is of 12th September.(Yesterday).

Even when I select data range as 11th sep to 11th sep then also in timeout panel its showing 1209 which is timeout data for 12th Sepetember.

<earliest>-1d@d</earliest>
<latest>@d</latest>

Can you guide me on that.

Below is my xml for First panel:

<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count</query>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<drilldown>
<set token="show_panel">true</set>
<set token="selected_value">$click.value$</set>
</drilldown>
</single>
</panel>

[ITWhisperer]

Hi @aditsss 

Would it be right to say that the single should be the count from the last day of the time period selected?

If so, add this to the time picker

<change>
  <eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest')),"-1m@d")</eval>
</change>

Then change the single query times to:

<earliest>$tokTimeStartOfDay$</earliest>
<latest>$field1.latest$</latest>

[aditsss]

Hi ITWhisperer,

Its not showing the correct data in the timeout panel.

I have attached the image as well. I have select the date range as 11th Sep to 11th Sep whose timeout data should be 3694 but its showing 2119.

Also when I am selecting last 7 days its showing timeout data as 0.

when I select sep 11 to sep 11 then it should show  3694 only which is actual data for sep 11. 

And when I select last 7 days say sep 6 to sep 12 . Then it should show sep 12 data only not the  total data.

And in the case where there is no data like suppose last 15 minutes,last 60 minutes then it should show "No result found" or "0"

Below is my xml code:

<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest')),"-1m@d")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $Org$ |stats count </query>
<earliest>$tokTimeStartOfDay$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>

[aditsss]

Hi ITWhisperer,

Can you please guide me on this.

[ITWhisperer]

Change the tokStartOfDay calculation slightly

<eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval>

Also, can you show the xml for the second panel? 

[aditsss]

Hi ITWhisperer,

I have change the token value but still same issue is arriving.

Can you please check on it. I have attached screenshot as well.

Incorrect data is coming in timeout Panel.

XML for 1st and 2nd panel:

<form theme="dark">
<label> Overview Clone</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="OrgName">
<label> Org Name</label>
<choice value="*">GCP1</choice>
<choice value="ABC">AT</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query>
<earliest>$tokTimeStartOfDay$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>
<panel>
<chart>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>

[ITWhisperer]

I can't see anything wrong with the xml. Can you try different days? Also, can you include screenshots of the time picker with the two panels?

[aditsss]

Hi ITWhisperer,

The time picker is same for both. Only I have pass the field1 earliest as the token for Timeout panel.

I have attached one screenshot where I select last 30 days but its showing 0 count in timeout panel.

I am selecting the vallues from date/time drop-down field.

Its not showing the correct data in timeout panel irrespective of the date range I am selecting from date drop-down.

XML

<form theme="dark">
<label>Salesforce Performance Overview Clone</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="OrgName">
<label> Org Name</label>
<choice value="*">GCP1</choice>
<choice value="ABC">ATM-PROD</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query>
<earliest>$tokTimeStartOfDay$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>
<panel>
<chart>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>

[ITWhisperer]

The last 30 days includes today - have there been any timeouts today? Perhaps rather than a line graph, display the results in a table (at least until we figure out what is wrong)?

[aditsss]

Hi ITWhisperer,

I have attached  the stastics screenshot for last 7 days. . 

Can you check. Still TimeOut panel is coming as 0.

XML

<form theme="dark">
<label>Salesforce Performance Overview Clone</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="OrgName">
<label> Org Name</label>
<choice value="*">GCP1</choice>
<choice value="ABC">ATM-PROD</choice>
....
.....
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="true">
<label>Date/Time</label>
<default>
<earliest>-1d@d</earliest>
<latest>@d</latest>
</default>
<change>
<eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<single>
<title>TIMEOUT</title>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query>
<earliest>$tokTimeStartOfDay$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="colorBy">value</option>
<option name="drilldown">all</option>
<option name="height">100</option>
<option name="numberPrecision">0</option>
<option name="rangeValues">[0,10,25,40]</option>
<option name="trendDisplayMode">percent</option>
<option name="trendInterval">-5m</option>
<option name="unit"></option>
<option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option>
<option name="useColors">1</option>
<drilldown>
<set token="show_panel3">true</set>
<set token="selected_value3">$click.value$</set>
</drilldown>
</single>
</panel>
<panel>
<chart>
<search>
<query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">line</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel> 

[ITWhisperer · Accepted solution]

The last 7 days includes today, and looking at the statistics, there have been no timeouts since 12th so 0 is correct.