Hi, I've got a table like this ts1 | ts2 | count | id 1461347440 | 1461347448 | 5 | 1234 1461347459 | 1461347452 | 10 | 1234 1461347455 | 1461347459 | 10 | 7899 I would like to sum "count" if ts1<=ts2 , for each id. My approach looks like this, but it seems to fail because of the field comparison | eventstats sum(eval(if(ts1<ts2, count, null()))) AS sum BY Id Can you help me to get the wanted calculation? Thanks in advance Heinz ... View more

Hi, my events have a field with epochtime which I want to use in the very first pipe to filter the search Of course I can do it like sourcetype=foo field<=1461110400 Is it somehow possible to use this filter as a readable date in the first pipe? Like in earliest earliest="04/20/2016:00:00:00" Cheers Heinz ... View more

Hi, how do I have to configure a single visualization, so that a click on the value will open another dashboard? Thanks in advance Heinz ... View more

Hi, I've seen panels like this in a video. How can I center the panel title and color the background of the title? Thanks in advance ... View more

Hi, is it possible to use countrycodes like US, GB, CN for the geom command instead of ip or long/lat? Thanks in advance Heinz ... View more

Hi, is it possible to exclude one specific field in the foreach command? Currently it looks like this, but I want to exclude the "size" field here: | foreach * [eval <<FIELD>>=round('<<FIELD>>'/size*100, 2)] Cheers Heinz ... View more

Hi, my goal is to calculate the number of retained customers per month. So let's say our timerange starts in 2015-11 and 100 customer logged in during this month. Then I want to know how many of these 100 customers logged in in 2015-12 as well. And so on... In general: How many users logged in month n and in month n-1? The final table would look like this month | active customers | retained customers from previous month 2015-11 | 100 | - 2015-12 | 500 | 25 2016-01 | 1000 | 90 I'm using a search with timerange from 2015-11 to 2016-01 that ends up in correct results. sourcetype=logins | bucket span=1mon _time | stats count BY account_id, _time | eventstats values(_time) AS login_months BY customer_id | eval month=round(relative_time(_time, "@mon"), 0) | eval month_1=round(relative_time(_time, "-1mon@mon"), 0) | timechart span=1mon dc(eval(if(_time=month, customer_id, null()))) AS customers, dc(eval(if(_time=month AND login_months=month_1, customer_id, null()))) AS returning_customers But using an earlier start date (2015_07 - 2016_01) is also changing the number of retaining customers in 2015-12. This does not make sense and I can't figure out which part of the search is causing this issue. Thanks in advance ... View more