Hi I was wondering if there is a way to use the bucket command on fields that have text values. If not, is there a way to achieve this through other commands? For example, if I have the following in my log file: <time>: id=1, field1=abc, field2=blah, field3=290 <time>: id=2, field1=def, field2=blah, field3=2 <time>: id=3, field1=yyy, field2=blah, field3=90 <time>: id=4, field1=def, field2=blah, field3=9980 <time>: id=5, field1=zzz, field2=blah, field3=29023 <time>: id=6, field1=abc, field2=blah, field3=29330 I would like to bucket the results based on the field1 values, something similar to bucket field1 ... . Thanks for your help. Ranga ... View more

Hi I have a saved-search (my_search) that is configured to run every 30 minutes. It gathers aggregate data from the past 7 days. I have a form that has one input field. Based on the the input field value from this form, I would like to filter the results of my saved-search. I currently have this setup as: <form> <label>Test</label> <fieldset> <input type="dropdown" token="field1"> <label>Field</label> <choice value="1">A value</choice> <choice value="2">Another value</choice> <choice value="3">Second value</choice> </input> </fieldset> <row> <chart> <searchTemplate>| savedsearch "my_search" | search $field1$ | timechart count by field2 </searchTemplate> <title>My Chart</title> </chart> </row> </form> When I access the chart, a new query is issued based on the field1 value. Is there a way to force the chart to use the "saved" results from the previous run of the search and then apply the filter rather than issuing a new query every time I access the chart? Thanks for your help. Ranga ... View more

Hi I have a dynamic form that displays a chart. I was wondering if the following is possible: 1) Execute a "Saved Search" to populate the values for one of the form field's (dropdown) list. I tried using populatingSavedSearch and it does not work [see example below] 2) Execute the search for populating the chart in a schedule. I can do this for static searches. Since I have a need to pass in form field values to the search, this needs to work for dynamic searches. Can I replace the searchTemplate [see example below] with a searchName ? If not, is there another way to specify running the search on a schedule? Example configuration (does not work😞 <form> <label>Saved Search</label> <fieldset> <input type="dropdown" token="id"> <label>ID</label> <prefix>id="</prefix> <suffix>"</suffix> <populatingSavedSearch fieldForValue="idname" fieldForLabel="idname">saved_values </populatingSavedSearch> </input> <input type="time" /> </fieldset> <row> <chart> <searchTemplate>`summary` | search $id$</searchTemplate> <title>My Dynamic Saved Search</title> </chart> </row> </form> saved_values: index="list_app" | top limit=0 idname | fields + idname | sort idname summary: index="my_app" source="test*" Thanks for your help. Ranga ... View more