I am facing issues when I am trying to mouse over on the timechart to see the exact values on the graph. I am selecting "Last 30 days", there is one spike which shows up in the graph, but when I try to see the exact value of that point using mouse over, it is not pointing to that spike properly and keeps on flickering if I move the pointer there ? Any one has seen this issue before ? Please help how it can be resolved. This is sort of a flickering issue on the timechart during mouse over ? My timechart is plotting data points with a span of 5 mins for last 30 days. Also, second problem, is for last 30 days, it is adding shade of colors, so users are thinking that there are 3 colors in the timechart for IN and OUT, but for IN it is adding shade of blue color ? is it possible to disable that ? I have attached the image before hover and after hover. First Image - shows the high point and the shade of blue color (light blue) added to the graph ? Second Image - while trying to point the high point, mouse over is not going to that point properly to see the highest value ? ... View more

I am getting below error when the page first loads, after that when I manually select "Last 1 week" in the dropdown, the timechart displays. Below is the error , please help resolve the issue ? Invalid value "$week$" for time term 'earliest' I think, somehow, when the page loads, the token $week$ having a value of "-7d" is not working. Also, when I select the choice, the query is passed into the token and then the query is running using that token. Below is my code : <panel> <title>Bandwidth Utilization - Trend</title> <input type="dropdown" token="week" searchWhenChanged="true"> <label>Select Week</label> <choice value="-7d">Last 1 Week</choice> <choice value="-14d">Last 2 Weeks</choice> <choice value="-21d">Last 3 Weeks</choice> <choice value="-1mon">Last 1 Month</choice> <selectFirstChoice>true</selectFirstChoice> <default>-7d</default> <initialValue>-7d</initialValue> <change> <condition value="-7d"> <set token="comparestring">index=snmp sourcetype=snmp_ta_vpn earliest=$week$ latest=now | my search ..... </condition> <condition value="-14d"> <set token="comparestring">index=snmp sourcetype=snmp_ta_vpn earliest=$week$ latest=now | my search ..... <condition value="-21d"> <set token="comparestring">index=snmp sourcetype=snmp_ta_vpn earliest=$week$ latest=now | my search ..... <condition value="-1mon"> <set token="comparestring">index=snmp sourcetype=snmp_ta_vpn earliest=$week$@mon latest=now | my search ..... </condition> </change> <search> <query>index=snmp | dedup host | stats count</query> <earliest>-5m@m</earliest> <latest>now</latest> </search> <fieldForLabel>count1</fieldForLabel> <fieldForValue>count1</fieldForValue> </input> <chart> <search> <query>$comparestring$</query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> <refresh>2m</refresh> <refreshType>delay</refreshType> </search> <!--option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">large</option--> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Time</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">area</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">connect</option> <option name="charting.chart.showDataLabels">minmax</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">1</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="height">396</option> <option name="refresh.display">progressbar</option> </chart> </panel> ... View more

I have 3 columns in my search output. For e.g. date, col1, col2, col3. Date will be X-Axis The column chart will show the bars for the value of Col1 by date and I want to do the chart overlay for col2 and col3 on this column chart. At present, I can overlay col2 series values on the chart, but not able to figure out how can I overlay third col3 on the same column chart ? Please help in this ? For eg. attached image has the details (query output and graph I want to show ). The bars represents the avg number of hours users worked for that date, also the yellow line represents the same thing ( used appendcols with the same search to overlay the value on bars), so that it can show the trend. I want to add the third overlay ( red line), that will show the number of total users (user_count) on that particular day ? user_count and "Avg User Session Time" should be the overlay on the bars. Also, I am not able to sort the date properly, April values are showing first and then march values ? Below is my query : index=paloalto sourcetype="syslog" userid!="tem*" zone="VPN" | eval date=date_mday+" - "+date_month |stats earliest(_time) as earliest latest(_time) as latest by userid,status,date | sort date| where status="login" | eval duration=latest-earliest | stats avg(duration) as duration dc(userid) as user_count by date| eval duration=round(duration/60/60,0) | rename date as Date duration as "Avg User Session Time (Hrs)" | appendcols [ search index=paloalto sourcetype="syslog" userid!="tem*" zone="VPN" | eval date=date_mday+" - "+date_month |stats earliest(_time) as earliest latest(_time) as latest by userid,status,date | sort date| where status="login" | eval duration=latest-earliest | stats avg(duration) as duration by date| eval duration=round(duration/60/60,0) | rename date as Date duration as "Avg User Session Time" ] ![alt text][2] [2]: /storage/temp/286728-overlay.jpg ... View more