hello
I call a timechart from a loadjob command like below and it works
| loadjob savedsearch="admin:toto_sh:win timechart2"
But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?
| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false
thanks for your help
try loadjob with events argument set to true.
loadjob events=true savedsearch="admin:TOTO_sh:winevent timechart2"
@jip31
timechart will work only if your below search results has _time
fields. Is this search has _time
?
| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$
Hi no
you can see my search below
perfmon
earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false
This search should work. Because I don't see any restriction on _time
field. Is that possible to share more details about both searches ?
Pearhaps I am not clear
The search below works fine :
perfmon earliest=-7d latest=now
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false
But I need to transform it in a scheduled search in order to call it from my dashboard and to be able to display the resulys for a specific host from a text entry
So I have deleted | search host=$tok_filterhost$
in my scheduled search and I have added
| loadjob savedsearch="admin:TOTO_sh:winevent timechart2" | search host=$tok_filterhost$
in my dashboard
But with this, I am unable to filter the resulys by host...
The scheduled search works fine if I delete | search host=$tok_filterhost$
So I try to find a solution...