Hi Everyone, I`ve got a dropdown input that generates 30 date entries and stores the choice in the "date.tok2" token. I`d like to be able to pass the token to a table to run a search over the period chosen from the drop down, but this is not working as expected (not generating any results - I know the query works because if I run it independently it produces results, so the problem must be with the token). I`ve got an identical drop down menu that works fine and it successfully passes the token onto the table at the beginning of the dashboard (that token is called "date.tok" and is used to set "earliest_tok" and "latest_tok"). Any help would be greatly appreciated. <input type="dropdown" token="date.tok2" searchWhenChanged="true"> <label>Date</label> <fieldForLabel>Date</fieldForLabel> <fieldForValue>earliest</fieldForValue> <search> <query>| makeresults | timechart span=d count | sort - _time | where _time &lt;= relative_time(now(),"@d") | fields - count | eval Date = strftime(_time,"%d-%b-%y"), earliest=relative_time(_time,"@d"), latest=relative_time(_time,"@d") | dedup Date</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> <selectFirstChoice>true</selectFirstChoice> <change> <set token="earliest_tok2">$row.earliest$</set> <set token="latest_tok2">$row.latest$</set> </change> </input> <table> <search> <query>| ...| ...</query> <earliest>$earliest_tok2$</earliest> <latest>$latest_tok2$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">none</option> <option name="rowNumbers">false</option> <option name="wrap">true</option> </table>     ... View more

My inputs.conf on the rasberryPi look like this:   [monitor:///var/log/pihole.log] disabled = 0 sourcetype = pihole index = main [monitor:///var/log/pihole-FTL.log] disabled = 0 sourcetype = pihole:ftl index = main     Both log files exist in /var/log, but only one sourcetype gets sent to my indexer and that`s "pihole:ftl". Any assistance would be greatly appreciated. ... View more

Hello, We ingest data from a database using rising columns, however a small amount of events are missing from the index, although I can see them in DBConnect. The field that we use as a rising column is set as an identity column so I`m expecting that each new value is generated based on the current seed & increment. Query timeout is set to 30 seconds, max rows to retrieve is 0 (maximum),  fetch size is 300 and frequency is 60 seconds - from what I`ve observed this should be sufficient for our requirements. Any assistance would be greatly appreciated. Many thanks. ... View more