Is it possible to save a piece of a query that you use over and over again? For example, I want to exclude certain test IPs from all of my dashboard queries, so I might want to save and re-use the following fragment in a number of queries: IP!="Some IP" IP!="Some Other IP" Thanks, Jonathan ... View more

I have one query that returns SESSION_IDs of attempted orders: index=my_index "abc" | rex field=_raw "(?<SESSION_ID>pattern)" And I have a second query that returns SESSION_IDs of successful orders: index=my_index "def" | rex field=_raw "(?<SESSION_ID>pattern)" How do return the list of SESSION_IDs returned by the first query that are not returned by the second query? I assume this involves using a subsearch with the NOT keyword, but I can't figure out how to do it. Thanks! Jonathan ... View more

I have a dashboard where some of the chart queries are modified by the value of a dropdown: <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="time_window_tok" searchWhenChanged="true"> <label>Select a Time Window</label> <choice value="-1week">Past 7 Days</choice> <choice value="-1day">Yesterday</choice> <default>Past 7 Days</default> <change> <condition label="Past 7 Days"> <set token="bins_tok">7</set> </condition> <condition label="Yesterday"> <set token="bins_tok">24</set> </condition> </change> </input> </fieldset> Here is one of the queries (I removed everything extraneous): index=xyz earliest=$time_window_tok|s$ URI="something" | timechart partial=false bins=$bins_tok$ dc(IP) as MyResult Sometimes the chart inside the panel displays fine, and sometimes it never renders. Usually, when you refresh the browser, it displays correctly. Is there anything wrong with the way I'm doing this? Is there some attribute I can add to the XML to force the dashboard to wait until the queries are rendered? Thanks, Jonathan ... View more

Is there a reference that indicates which attributes are allowed in each of the different dashboard XML nodes? Or is there at least a document somewhere that describes the attributes in general, so I can experiment putting them in different places? Thanks, Jonathan ... View more

I'm using the _rex command and I want to create a regular expression that contains a literal double quote character. How do I do this? Thanks, Jonathan ... View more

I have a chart in which each bar represents a day's worth of data. Even though the values for _time are formatted like "2017-11-29" when I run the query, the values along the X-axis of the chart are displayed in the following format: 2017-11-29T00:00:00.000-05:00 Does anyone know how to get the values along the x-axis to display in the "2017-11-29" format? Thanks, Jonathan ... View more

I would like to use the transaction command to find adjacent log entries with the same IP and different Session IDs. Ideally, I would only like to return adjacent pairs of log statements with at least a 15 minute timestamp difference between them. Here is the REX I'm using to extract SESSION_ID: rex field=_raw "-S:(?<SESSION_ID>\w+)-" Thanks! Jonathan ... View more