<dashboard> <label>24 HOUR LOG FEED MONITOR</label> <description>Log feed monitor for 24 hour monitoring</description> <row> <panel> <title>24_hour_log_feed_monitor</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-48h by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-24h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="drilldown">none</option> <format type="color" field="minutesago"> <colorPalette type="list">[#53A051,#F8BE34,#DC4E41]</colorPalette> <scale type="threshold">10,1440</scale> </format> </table> </panel> </row> <row> <panel> <title>10 MINUTES LOG FEED MONITOR</title> <table> <search> <query>| tstats latest(_time) as latest where index=* earliest=-10m by host | eval minutesago=round((now()-latest)/60,0)</query> <earliest>-10m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="minutesago"> <colorPalette type="list">[#FF000,#F8BE34,#DC4E41]</colorPalette> <scale type="threshold">1,10</scale> </format> </table> </panel> </row> </dashboard> ... View more

You probably need to change the order of the fields you are grouping by in the stats command. You should also remove the first for each cluster. Also, should b_usage be based on a?   MY_SEARCH_COMMAND | bin _time span=1d | eval resource_a_total = a_val * threshold | eval resource_a_total = b_val * threshold | stats sum(resource_a_used) as a_used, sum(resource_a_total) as a_total, sum(resource_b_used) as b_used, sum(resource_b_total) as b_total by cluster _time | eval a_usage =round(a_used / a_total * 100, 2) | eval b_usage =round(b_used / b_total * 100, 2) | autoregress a_usage p=1 | eventstats first(_time) as firsttime by cluster | where _time != firsttime | eval a_diff = a_usage - a_usage_p1 | table name a_usage a_diff b_usage     ... View more

So now you want the first non-zero count and the last non-zero count, right? <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time | stats count by _time | eventstats first(_time) as firsttime last(_time) as lasttime | where _time = firsttime OR _time = lasttime | fields _time count </query>   ... View more