I don't believe you can use colour names, such as Green and Yellow, you have to use hex codes or RGB, see here https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsXML#Color_palette_types_and_options in your case it's interesting that you have yellow, as I would expect black if it does not understand colour names. Have you tried <colorPalette type="expression">if(value == "up","#00FF00", "#FFFF00")</colorPalette> ... View more

If you post your existing XML it would be helpful, but I am assuming you have something like <drilldown> <set token="token_icid">$row.icid$</set> </drilldown> so there are a number of ways to do what you want, but one way is to make and additional constraint for icid that is either empty or the check, as the rest of the search is the same. <drilldown> <set token="token_icid">$row.icid$</set> <eval token="token_query">if($row.icid$=0, "icid=\"".$row.icid$."\" OR ", "")</eval> </drilldown> Then your search can be index=fed:xxx_yyyy sourcetype="aaaaa:bbbbb:cccc" source_domain="$token_source_domain$" AND ($token_query$ mid="$token_mid$" OR "MID $token_mid$") so you just add $token_query$ which is either empty or the addition icid constraint.   ... View more

@Roy1 Can I question your first (15 seconds of activity) where there are only 2 events 12:00:30 x=1600 y=850 z=60 equipmentID=1 12:00:35 x=1600 y=850 z=60 equipmentID=1 where x,y and z are the same, so I am not clear on how you get 15 seconds active. It seems like 5 or 10 seconds.  The 135 also seems like it should be 145 Here is an example using your data that gives you a timechart - NB: It's only done with a single equipmentID, so needs to be tested with more than one Id | makeresults | fields - _time | eval d=split(replace("12:00:10 x=1000 y=500 z=300 equipmentID=1 12:00:15 x=1000 y=500 z=300 equipmentID=1 12:00:20 x=1025 y=525 z=275 equipmentID=1 12:00:25 x=1000 y=500 z=300 equipmentID=1 (20 seconds of inactivity) 12:00:30 x=1600 y=850 z=60 equipmentID=1 12:00:35 x=1600 y=850 z=60 equipmentID=1 (15 seconds of activity) 12:03:00 x=1650 y=950 z=300 equipmentID=1 (135 seconds of inactivity) 12:03:05 x=1850 y=500 z=650 equipmentID=1 12:03:10 x=2500 y=950 z=800 equipmentID=1 12:03:15 x=2500 y=950 z=400 equipmentID=1 12:03:20 x=2500 y=950 z=150 equipmentID=1 (15 seconds of activity)", " ","##"),"##") | mvexpand d | rename d as _raw | extract | rex "(?<time>\d+:\d+:\d+)" | eval _time=strptime(time, "%H:%M:%S") | eval description=if(isnull(_time), _raw, null()) | fields - _raw time | where isnotnull(_time) | sort _time ``` The above is just data setup ``` | streamstats time_window=10s count range(x) as r_x range(y) as r_y range(z) as r_z by equipmentID | eval isIdleByCoord=if(r_x<=50 AND r_y<=50 AND r_z<=50, 1, 0) | streamstats window=2 global=f range(_time) as r by equipmentID | timechart fixedrange=f sum(eval(if(isIdleByCoord=1, r, null()))) as InActive by equipmentID It calculates isIdleByCoord is calculated in a 10 second window. If there is no activity for a piece of equipment then it will not have a data point, so the 'r' calculation will show the range of the previous point. Let me know if this helps ... View more

Use the aligntime parameter to timechart, i.e. | timechart span=30m aligntime=@m... ... View more

Not sure if this is what you're trying to do, but you can always 'remove' the dates you don't want with a where clause If compliant7sma field does not exist for the first 6 days, then just add | where isnotnull(compliant7sma) at the end, or to do it on a time based filter | where _time>=relative_time(now(), "-30d@d") ... View more

Something as simple as this should work search ... | stats range(_time) as duration by userId, traceId | stats sum(duration) as duration by userId | eval connected=tostring(duration, "duration") based on your data example, where traceId indicates the connection boundaries, so stats by the traceId and userId will get the duration for each session and then stats to sum the durations. If there is no disconnection event, then the range(_time) will be 0, so any active connections will not be counted. If you want to calculate that based on the time of the search you could do this | stats count min(_time) as start_time range(_time) as duration by userId, traceId | addinfo | eval duration=if(duration=0 AND count=1, info_max_time - start_time, duration) | stats sum(duration) as duration by userId | eval connected=tostring(duration, "duration") which would treat the ending time range of the search to be the ending range of an open connection. and finally to handle all cases where you may have no start or not end event, try this one search... | eval type=if(match(message,"created"),1,2) | stats count values(type) as types min(_time) as first_event_time range(_time) as duration by userId, traceId | addinfo ``` Handle created but no disconnect ``` | eval duration=if(duration=0 AND count=1 AND mvcount(types)=1 AND types=1, info_max_time - first_event_time, duration) ``` Handle disconnect but no created ``` | eval duration=if(duration=0 AND count=1 AND mvcount(types)=1 AND types=2, first_event_time - info_min_time, duration) | stats sum(duration) as duration by userId | eval connected=tostring(duration, "duration") ... View more