Hello, I am creating a dashboard with below searches to customize number of data points and time span displayed (using timechart) when different timerange is selected. Search 1 - Chart Span: ...
See more...
Hello, I am creating a dashboard with below searches to customize number of data points and time span displayed (using timechart) when different timerange is selected. Search 1 - Chart Span: based on, custom timerange token, this returns span period and top values to be used in Search 3, given below. | makeresults
| eval spantime=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")","1h",$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","1d",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","1h",true(),"1d")
| eval startOfMonth=relative_time(now(),"@mon")
| eval noOfDays=round((now()-startOfMonth)/86400)
| eval startOfDay=relative_time(now(),"@d")
| eval noOfHours=round((now()-startOfDay)/3600-1)
| eval topvalues=case($timerange|s$="| where calldate>=relative_time(now(),\"@mon\") AND calldate<relative_time(now(),\"@d\")",$noOfDays$,$timerange|s$="| where calldate>=relative_time(now(),\"@d\") AND calldate<relative_time(now(),\"@m\")","$noOfHours$",$timerange|s$="| where calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\")","30",$timerange|s$="| where calldate>=relative_time(now(),\"-7d@d\") AND calldate<relative_time(now(),\"@d\")","7",$timerange|s$="| where calldate>=relative_time(now(),\"-24h@h\") AND calldate<relative_time(now(),\"@h\")","24",true(),"1d") Search 2 - Saved Search: this is a report returning below fields: | table Date Duration "Handled by" Queue _time Search 3 - Chart: using Search 2 as base search and search result token values from Search 1: | timechart span=$Chart Span:result.spantime$ count as HourlyCalls
| sort $Chart Span:result.topvalues$ -_time now, when I load the dashboard, default timerange is calldate>=relative_time(now(),\"-30d@d\") AND calldate<relative_time(now(),\"@d\") , based on this I would expect Search 3 as, | timechart span=1d count as HourlyCalls
| sort 30 -_time but it shows below error message: Set token value to render visualization
$noOfDays$
$noOfHours$
$spantime$
$topvalues$ can someone please suggest what is wrong here and how can I fix this? Thank you.