I have a search that is returning the value of a field called num_oracle_batch. I am using the following to get a per_minute count of the number of batches:
timechart span=1m per_minute(num_oracle_batch)
My question is, how can I limit the timechart to only show where the value of num_oracle_batch is an actual number. As it stands, if I choose today from the timepicker, my Y axis is the entire day even though I only had matching search results in only a few minutes in the 9 oclock hour.
So in short, can I dynamically set my timerange based on event results?
You can add
cont=f to the timechart options, making the chart not continuous. With that, your timechart becomes:
timechart span=1m per_minute(num_oracle_batch) cont=f
Let me know if that doesn't work.
Thats exactly what I was looking for. I have been struggling with sub-searches and where clauses to get what I was looking for.