trying to calculate groupings of VMs capacity growth over time but a chart or table looks to be the best answer if you need to report on 100 VMs. In a simplified data set per below Date ,Name,Capacit Used 5/1/2019, VM1,100 5/1/2019, VM2,100 5/1/2019, VM4,450 6/1/2019, VM1,100 6/1/2019, VM2,140 6/1/2019, VM4,450 7/1/2019, VM1,105 7/1/2019, VM2,200 8/1/2019, VM1,110 8/1/2019, VM2,200 9/1/2019, VM1,110 9/1/2019, VM2,200 10/1/2019,VM1,110 10/1/2019,VM2,200 10/1/2019,VM3,100 11/1/2019,VM1,110 11/1/2019,VM2,200 11/1/2019,VM3,200 How can you search it so that if you search for 7/1/2019 through 11/1/2019 that the result would be tabled as VM1 5GB VM2 0GB VM3 200GB So this almost needs to be like a delta except that its clobbered by VMs that are not in the beginning or ending of the time range. If a VM is created in the time range then its starting capacity should be 0 ... View more

Date, VM1, VM2, VM3, VM4 5/1/2019 100, 100, n/a, 450 6/1/2019 100, 140, n/a, 450 7/1/2019 105, 200, n/a, n/a 8/1/2019 110, 200, n/a, n/a 9/1/2019 110, 200, n/a, n/a 10/1/2019 110, 200, 100, n/a 11/1/2019 110, 200, 200, n/a I guess I can do this in different ways but from above but I'm trying to be able to specify 2 times from a time picker & then be able to report on overall capacity growth. I thought charting w/ earliest(VM) & latest(VM) but that does not work. if VMs exist on both start/end- it works great. The problem is that if a VM has been decommissioned (per above VM4) or if it was newly created (VM3) then earliest/latest for those 2 are not reported accurately. Above VM3 would report that it grew 100 when it really grew 200 from 5/1 to 11/1. VM4 reports no growth when it should read (-450) because it no longer exists. Anyone else run into issues like this & have ideas on correctly reporting on this scenario? ... View more

Just now getting into datasets & when I create one.. 5 columns of very useful data & it sure looks like a lookup table. Is there a way to use it as a look up table? Convert it to a lookup table? ... View more

What would be the easiest one line solution to remove special characters from a token? I'm taking a text input (mac addresses like 00:1B:44:11:3A:B7) from the user, & 1 source type uses the exact address & another source type has no ":" in the address. I'm using the token as the complete search item (does the search content have a imbedded variable?). When I do things like add a token to an eval command, it doesn't work. It seems like there should be an easier way to get around this problem. ... View more

Is there a way w/ the new feature for coloring ranges on values such as Blank or Contains? I've tried things like NULL or " " or "" or just nothing for a blank line. Why dont wildcards work? Something like word to color anything w/ the word "word" in it? Is there a nice work-around for this? ... View more

sourcetype=pools Fields- poolname, poolsize sourcetype=poolcomponents Fields- componentname, poolname, componentsize, componentused, componentfree I'd like to run something like (I know the pools field is a single event for multi poolcomponents events) Sourcetype=pool* <-- I can see all my fields chart sum(componentsize)/poolsize) as "Percent Pool Utilized" by poolname <-- to get a % used of the all the pools I'd like it to be flexible where I can eventually timechart & predict these results. Is there a simple way to do this? ... View more