I have 3 sourcetypes representing learners, courses and course completion details learners - the learner details catalog - the total course catalog for each learner completions - the course completions for the learer Amongst other fields, "learners" contains Username, Name "catalog" contains Username, Asset_Title "completions" contains Username, Asset_Title I want to produce a report showing each learner, the total number of courses in their catalog and the total number of courses they have completed along with a % completion. The following search almost gets there. | set intersect [ search sourcetype=catalog* | fields Asset_Title, Username | fields - _* ] [ search sourcetype=completions* | fields Asset_Title, Username | fields - _* ] | eventstats dc(Asset_Title) as Count by Username | join Username [ search sourcetype=learners* ] | stats Count by Name but I can't see how to get the total courses from the catalog for each learner to be retained as a field after the set operation, so I can add that as a Total field and calculate the %. ... View more

I've just noticed that 6.0.1 is released. I have a 6.0 tarball install. Not having done this before, is the normal way to update to 6.0.1 just to untar the new version on top of the old. I am assuming this will not overwrite my config. I have not made any changed to the default branch of any directories. Naturally I will backup first... ... View more

My data consists of login events to a system. Each user belongs to a Company, of which there are 12 companies represented. The event date is the login time. Fields are Company - Company code Co_Name - Company name Name - User's name I want a report to show : For each company, the users with the most logged in days, i.e. only one login counts per day, during a given period. I can achieve the top user per company like this sourcetype=logins* | stats dc(Date) as Count by Name, Co_Name | sort Co_Name, -Count | dedup Co_Name but if there is a company with more than one user with the same number of logged in days, I will only get one, whereas I want all the users for that company with that max login count. I tried this one sourcetype=logins* | top showperc=false 1 Name, Company by Co_Name but that does not take account of more than one login per day, which should only count 1. I feel there would be a more correct way to achieve this other than my search string above... ... View more

I have a Simple XML dashboard which does <form> <label>Admin Dashboard</label> <description/> <fieldset> <input type="dropdown" token="company" searchWhenChanged="true"> <label>Select a Company:</label> <default>*</default> <choice value="*">All Companies</choice> <populatingSearch fieldForValue="Company" fieldForLabel="Co_Name"> <![CDATA[ | inputlookup rich-co ]]> </populatingSearch> </input> <input type="time" searchWhenChanged="true"> <label>Select a time</label> <default> <earliestTime>-7d@w0</earliestTime> <latestTime>@w0</latestTime> </default> </input> </fieldset> <row> <single> <searchString>sourcetype=completions_standard Company=$company$ | eval f=if("$company$"=="*","All Companies",Co_Name) | table f</searchString> <earliestTime>$earliest$</earliestTime> <latestTime>$latest$</latestTime> </single> </row> <row> <chart> <title>Last week's visitors to the Knowledge Centre</title> <searchString>sourcetype="logins_*" Company=$company$ | timechart dc(Username)</searchString> <earliestTime>$earliest$</earliestTime> <latestTime>$latest$</latestTime> <option name="charting.chart">area</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">all</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.placement">none</option> <option name="wrap">true</option> <option name="rowNumbers">false</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="charting.axisTitleY.text">Users</option> <option name="charting.axisLabelsY.majorUnit">10</option> <option name="charting.axisTitleX.text">Date</option> </chart> </row> </form> When I open the dashboard, both panels have the text Search query is not fully resolved Any idea what's wrong? ... View more