index=myindex sourcetype=mylog | eval productname=case(productid==12,"Product1",productid==13,"Product2",productid==14,"Product3")| timechart count by productname ... View more

It was the same for me in IE8, and solved it by adding to the aplication.css : .TimeRangePicker { width: 165px; } ... View more

[WMI:LocalPhysicalDisk] interval = 3600 wql = select Name, CurrentDiskQueueLength, DiskBytesPerSec, PercentDiskReadTime, PercentDiskWriteTime, PercentDiskTime from Win32_PerfFormattedData_PerfDisk_PhysicalDisk index = default disabled = 0 [WMI:LocalProcesses] interval = 3600 wql = select Name, IDProcess, PrivateBytes, PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process index = default disabled = 0 [WMI:Memory] interval = 3600 wql = select PagesPerSec, AvailableMBytes, CommittedBytes, PercentCommittedBytesInUse from Win32_PerfFormattedData_PerfOS_Memory index = default disabled = 0 [WMI:LocalNetwork] interval = 3600 wql = select Name, BytesReceivedPerSec, BytesSentPerSec, BytesTotalPerSec, CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface index = default disabled = 0 [WMI:CPUTime] interval = 3600 wql = SELECT PercentProcessorTime,PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total" index = default disabled = 0 ... View more

You could use the Export module instead of the old ResultsActionButton <module name="Export" > <param name="exportType">result</param> </module> ... View more

You should first convert to epoch time, something like this: | convert timeformat="%y-%m-%dT%H:%M:%S" mktime(end_time) mktime(start_time) | eval duration=end_time-start_time ... View more

try: TIME_FORMAT=%y%m%d%H%M%S TIME_PREFIX=^ ... View more