Why doesn't this work? If I run the search without earliest and latest and use the time picker instead, I get results. I'm working with the SDK, so a timepicker is not available. I give the user date range selections, such as shown here. The parameters properly pass but I can't get any results. I am using the same search in an Advanced XML dashboard with a time picker and it works perfectly. What am I missing?
[|inputlookup Master.csv | where cab!="NULL" AND subbranch="Act" | fields username ]
| search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\ABCD\\*"
| lookup Master.csv username output cab | where cab!="NULL"
| stats sum(filesize) as ABCD by cab
| eval ABCD=floor(ABCD/1024/1024)
| appendcols [search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\DEFG\\*"
| lookup Master.csv username output cab | where cab!="NULL"
| stats sum(filesize) as DEFG by cab
| eval DEFG=floor(DEFG/1024/1024)]
| appendcols [search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\HIJK\\*"
| lookup Master.csv username output cab | where cab!="NULL"
| stats sum(filesize) as HIJK by cab
| eval HIJK=floor(HIJK/1024/1024)]
| appendcols [ search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\LMNO\\*"
| lookup Master.csv username output cab | where cab!="NULL"
| stats sum(filesize) as LMNO by cab
| eval LMNO=floor(LMNO/1024/1024)]
| appendcols [search index="WMICustom" sourcetype="WMICustom" earliest=-30d latest=+6h Message="*\\STUV\\*"
| lookup Master.csv username output cab | where cab!="NULL"
| stats sum(filesize) as STUV by cab
| eval STUV=floor(STUV/1024/1024) ]
| stats first(STUV) as STUV, first(DEFG) as DEFG, first(HIJK) as HIJK, first(LMNO) as LMNO, first(ABCD) as ABCD by cab
| fillnull value="0" STUV, DEFG, HIJK, LMNO, ABCD
| rename ABCD to ABCD-A(E), cab as CAB
| table CAB, STUV, DEFG, HIJK, LMNO, ABCD
| sort CAB
| addtotals fieldname="Total (MB)"
| addcoltotals
... View more