help to display a timechart after a loadjob command

[jip31]

hello

I call a timechart from a loadjob command like below and it works

| loadjob savedsearch="admin:toto_sh:win timechart2" 

But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" 
| search host=$tok_filterhost$ 
| timechart count by sourcetype limit=10 useother=false

thanks for your help

[alexforkosh]

try loadjob with events argument set to true.

loadjob events=true savedsearch="admin:TOTO_sh:winevent timechart2"

[kamlesh_vaghela]

@jip31

timechart will work only if your below search results has _time fields. Is this search has _time?

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$

[jip31]

Hi no
you can see my search below
perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

[kamlesh_vaghela]

This search should work. Because I don't see any restriction on _time field. Is that possible to share more details about both searches ?

[jip31]

Pearhaps I am not clear
The search below works fine :

perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false

But I need to transform it in a scheduled search in order to call it from my dashboard and to be able to display the resulys for a specific host from a text entry
So I have deleted | search host=$tok_filterhost$ in my scheduled search and I have added

| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" | search host=$tok_filterhost$ 

in my dashboard
But with this, I am unable to filter the resulys by host...
The scheduled search works fine if I delete | search host=$tok_filterhost$
So I try to find a solution...