Hi, I have sample xml as shown below, I'm trying to show the panel based on the choice but it is not working. Please help on this. required: If I select first drop down panel will be displayed dynamically and than if i select any value in 2nd drop down, Corresponding panel will be displayed at the same time first panel has be hided. same like 3rd drop down, if select any value in 3rd drop down than 1st & 2nd panels will be hided and 3rd panel will be opened. Could you please check with my sample xml and suggest me where it wrong. Thanks in advance. <form> <label>Test</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="tkn_sourcetype" searchWhenChanged="true"> <label>Select Sourcetype</label> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <choice value="*">ALL</choice> <initialValue>*</initialValue> <change> <condition label="sourcetype"> <set token="token_sourcetype"></set> <unset token="token_component"></unset> <unset token="token_group"></unset> </condition> </change> <search> <query>index=_internal sourcetype=* | dedup sourcetype | table sourcetype</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="tkn_component" searchWhenChanged="true"> <label>Select Component</label> <fieldForLabel>component</fieldForLabel> <fieldForValue>component</fieldForValue> <choice value="*">All</choice> <initialValue>*</initialValue> <change> <condition label="component"> <set token="token_component"></set> <unset token="token_sourcetype"></unset> <unset token="token_group"></unset> </condition> </change> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" component=* | dedup component | table component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="tkn_group" searchWhenChanged="true"> <label>select group</label> <fieldForLabel>group</fieldForLabel> <fieldForValue>group</fieldForValue> <choice value="*">All</choice> <change> <condition label="group"> <set token="token_group"></set> <unset token="token_sourcetype"></unset> <unset token="token_component"></unset> </condition> </change> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" component="$tkn_source$" | dedup group | table group</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> <row depends="$token_sourcetype$"> <panel> <chart> <title>test</title> <search> <query>index=_internal sourcetype="$tkn_sourcetype$" | stats count by sourcetype</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row depends="$token_component$"> <panel> <chart> <title>test</title> <search> <query>index=_internal component="$tkn_component$" | stats count by component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row depends="$token_group$"> <panel> <chart> <title>test</title> <search> <query>index=_internal component="$tkn_group$" | stats count by component</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> </form> ... View more

Hi All, i have a events as mentioned below. 02/04/2019 19:58:01 this is from A4: message from something 02/04/2019 19:31:01 this is from A3: message from something 02/04/2019 19:22:01 this is from A2: message from something 02/04/2019 19:20:01 this is from A1: message from something i would like to calculate time difference/duration between events like A1 to A2, A2 to A3, A3 to A4 and etc..could you please help on this. ... View more

Hi, i have a bar chart, Query is index=xxx sourcetype=xxx |timechart count. I am running this query today span. once i click on the bar, based on that particular time and count should be displayed in the another chart i.e, table Query 1:iIndex=xxx sourcetype=xxx |timechart count <drilldown> <set token="timetk">$click.name2$</set> <eval token="date1">strftime($click.value$,"%Y-%m-%d %H:%M")</eval> </drilldown> Query 2: index=xxx sourcetype=xxx $date1$ | table _time some-field when i run this, if it is last 24 hours or Today span , its not working properly,if bar showing 10AM count 10, once you click on it its taking 22:30 and if it is 10:30 AM, once you click on it, its taking 23:00, after 12PM count's, once you click on it, its considering next day like once you click on today i.e, Feb 11th 2PM, its taking tomorrow i.e, FEB 12th 2:30AM. my time stamp is Could you plz help on this. ... View more

I have a column chart which displays three legends like success,failure and total count's by _time. I want to drill down to another table chart, if i click on success count, that count and _time should be displayed in a table. for example, if success count is 10 on jan 2nd 2019, if click on that, _time and count should be displayed, and failure and total too. could you help on this.? ... View more

i have query like: | timechart count by status. output: _time status 1/1/2018 20:10:12.214 2 10/1/2018 12:32:45.153 4 when i click on the bar chart legend, _time should pass to another chart date, hour and minutes only like 1/1/2018 20:10 as a token. another chart query is index=something $token_name$ | stats count @martin_mueller , could you help on this. ... View more

Hi, I have data like mentioned below 28-11-01 10:30:13,127 digits=30 28-11-01 07:20:08,240 digits=50 28-11-01 05:01:18,101 digits=60 28-11-01 12:12:22,127 digits=120 09-12-01 12:12:22,127 digits=180 10-01-01 05:01:18,101 digits=500 i want to display the latest digit using a timeline chart. I have written a query like | timechart latest(digits) as latestRecord and it's working fine, but when running this a couple of times in the span of the last 3 months, November months keep changing the output. Like one time, it's displaying 30 — another time 50, 60, 120 like that if i run multiple times also, expected output: 2018-11 30 2018-12 180 2019-01-500 ... View more

HI, I have a simple query i.e |timechart count by something The span should change dynamically, for EX: if I select today, the span should be 1h — if I select last months span, it should be 1d — if i select the last 3 months' span, it should be 1mon, |timechart span=$$ count by something. Plz help me on this. ... View more

HI, I have a query index=something | timechart latest(fieldA) as datavalues by dataNames. when i select the time duration Today or Yesterday up to last 30days , it's working fine. If I select the last 3 months, it's displaying the wrong results. Can you please help me on this? ... View more