Since upgrading from 5 to 6, one of my dashboards started behaving "strangely", and I have distilled it down to this.
If I have a dashboard that uses "stats" and "first"
<dashboard>
<label>TimeTest</label>
<description>TimeTest</description>
<row>
<table>
<searchString> index=_internal
|stats first(_time) as f, last(_time) as l by sourcetype
|eval d = f - l
|fieldformat f = strftime(f, "%c")
|fieldformat l = strftime(l, "%c")
|table sourcetype f l d
</searchString>
<earliestTime>-2mon</earliestTime>
<latestTime>now</latestTime>
</table>
</row>
</dashboard>
This produces some strange results for me when I run it I get cases where "first" is further in the past than "last" - giving negative values for 'd'.
If I then click "Open In Search" - the same results are shown (as expected), but is the then click on the magnifying glass to do the search again.......I get sensible values for all with positive values for 'd'
The above case does take a while to run, but it is example of what I am experiencing in a form that others can, hopefully, reproduce.
All help much appreciated.
