I have same problem but can't get the solution I need.. I have indexed data with fields conferenceID "start Time" "End Time" I basically wants to get output by taking "Start Time" when ever I search using time-picker. problem: it is always taking _time and giving wrong results but after below query it gives 0 results. index=test sourcetype=webex "testinc" | eval _time=strptime("Start Time","%Y-%m-%d") | sort - _time | addinfo | where _time>=info_min_time AND (_time<=info_max_time OR info_max_time="+Infinity") |table ConferenceID "Start Time" "End Time" ... View more

i have poweruser roles not the admin roles and if i try doing search with index=test "index=test action=search" nuthing shows up it looks like no action field available for every index ?? ... View more

I wanted to see how usage looks like. ex.. if we doing 30% of data in index or calculation of all events and space using or may be how it runs month to date and shows usage looks like. ... View more

any suggestions ... View more

any suggestions ... View more

I was looking to find out details for index=test how much data is written on index ? how often index=test is used in search queries? ... View more

yes exactly both ... View more

for my admin as well there is only 2 options in permissions 1. private 2 ."this app only" or you saying, ask him to upload my lookups from his side and change permissions to "All Apps" ? or can he change permissions of my "private lookups" which i want to make it "globally" ? ... View more

yes I had a look, it seems to be good solution but as you see my query is pretty big . and I am new to this, wondering if you can able to fix somehow. ... View more

any suggestions? ... View more

thanks for replying, but it seems query is correct. but the timezones are giving problem. ... View more

could you help me with this same loggic as you explained but cannot find a fix to this query it is basically add all total_calls by name. when you select in time picker for one day 2 days or last 7 days so on.... I want to get total_calls per day and show in a graph for 30 days. cdr_events (callingPartySubgroup="$selectgroup$" OR originalCalledPartySubgroup="$selectgroup$" OR finalCalledPartySubgroup="$selectgroup$") dest_device_type="hardphone" OR orig_device_type="hardphone" duration>0 | eval number=mvappend(if(callingPartySubgroup="$selectgroup$",callingPartyNumber,null()), if(originalCalledPartySubgroup="$selectgroup$", originalCalledPartyNumber,null()), if (finalCalledPartySubgroup="$selectgroup$", finalCalledPartyNumber, null())) | mvexpand number | search number=* | fillnull callMediaType value="unknown" | eventstats dc(callId) as calls sum(duration) as seconds by number callMediaType | eval number_media_calls_seconds=number + "::" + callMediaType + "::" + calls + "::" + seconds | get_call_concurrency(number_media_calls_seconds) | timechart_for_concurrency(number_media_calls_seconds,50000) | eval day_of_week =strftime(_time,"%a") | eval hour_of_day=strftime(_time,"%H") | eval is_business_hours=case((day_of_week=="Sat" OR day_of_week=="Sun"),0,(hour_of_day>7 AND hour_of_day<17),1,true(),0) | search is_business_hours=1 | fields - day_of_week hour_of_day is_business_hours | untable _time number_media_calls_seconds active | eval number_media_calls_seconds=split(number_media_calls_seconds,"::") | eval number=mvindex(number_media_calls_seconds,0) | eval media=mvindex(number_media_calls_seconds,1) | eval calls=mvindex(number_media_calls_seconds,2) | eval seconds=mvindex(number_media_calls_seconds,3) | eval minutes=round(seconds/60,2) | eval {media}_minutes=minutes | eval {media}_calls = calls | eval active=if(active>0,1,active) | stats values(video_calls) as video_calls values(audio_calls) as audio_calls values(audio_minutes) as audio_minutes values(video_minutes) as video_minutes count(eval(active=1)) as active count(eval(active=0)) as inactive by number |fillnull audio_minutes, video_minutes, audio_calls, video_calls value="0" | eval total_calls=audio_calls+video_calls | eval total_minutes=audio_minutes+video_minutes | eval utilization=round(100*active/(active+inactive),2) | lookup groups number OUTPUT name group subgroup |search number!=OTHER | fields name number group subgroup audio_minutes video_minutes total_minutes audio_calls video_calls total_calls utilization |fields - number group subgroup audio_minutes video_minutes audio_calls video_calls ... View more

thank you for replying but timechart command is not working as there are no logs. basically using api's to get values. ... View more

thanks this worked for me. while keeping 'present' and 'date range' using above css, i also need to keep only "week to date" and "month to date" "previous week" and previous month" in the 'present'./ can help me with this. ... View more

have a question what if we want to show data values of more than thousands with "k" ex., 1000 = 1k or 2000=2k on the bar graph not on the x-axis or y-axis ... View more