Im using the search below and basically want a chart showing last 12 dates going oldest to newest from left to right by date.  | inputlookup running_data.csv | eval EP=strptime(Date, "%m/%d/%Y") | eval Date=strftime(EP, "%m/%d/%Y") | chart sum(sats) over team by Date useother=false limit=12 | fillnull value=0 The search was working fine up until January and year change, now the search only shows the last date in December and is missing the newest  01/02/2024 date.  If I change the limit to be large enough to include all date entries in the csv file, I discovered the below: Its putting the 01/02/2024 date before the oldest date in the csv, instead of putting that 01/02/2024 column after the 12/18/2023 date column.  So its like its ignoring the year and going by month chronologically. Done quite a bit of searching on this to no avail, and seems like this should be an easy thing to do... Im not opposed to not using "chart" if someone has a better way.  Ideally the search returns the last 12 dates from oldest to newest in the columns and then the team name and numbers sats on that date in the rows.  Thansk for any suggestions!

Hi,  I am trying to create a splunk classic dashboard, but struggling with setting the earliest values. The goal is to run a search, and have the results pull data from 2 different index files while controlling the data pulled from the first index by a dropdown time parameter. The SPL is part of a radio button option with the dashboard and starts as such: ( (index=first_index source="first_file_location" $time_range$ latest=-1d@d() ) OR (index=second_index earliest=@d latest=now() source="second_file_location") ... rest of the SPL time_range token is the dropdown input with a static value set to earliest=-7d@d() When I run the search, it is not substituting the static value into the search, and is populating it as the token name with the $ sign. Would it be possible to set the earliest value for the first index using a dropdown menu. Any assistance would be greatly appreciated. Thanks