Hello, I am trying to build a role that would allow the users to access to two indexes (index1 and index2). The index1 has a field called parameter and I want the role to restrict search filter to parameter=value . But when I do this (see code below), I don't have access anymore to my index2. How could I avoid this ? Thanks ! [role_test] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = user srchIndexesAllowed = index1, index2 srchIndexesDefault = index1 srchFilter = parameter=value srchMaxTime = 0 ... View more

Hi ! I am trying to display a timechart that gives the data of a week, and the data of the same week but one year earlier. I have done something with timechart and timewrap that gives me that comparison, but also gives me the comparison of all the rest of the year. How can I just isolate a specific week ? Thanks ! My current request : index="sales_2017" OR index="sales_2018" | timechart span=d count | timewrap y What I got : What I would like to have : ... View more

Hi ! I am trying to build a two way table like : | | Male | Female | Total | | Child | 2 | 3 | 5 | | Teenager | 2 | 1 | 3 | | Adult | 10 | 11 | 21 | I see how to count by gender or by age but I don't see how I can have both in the same table. Your help will be very appreciated, thanks! ... View more

Hi, I am trying to compare the top sales of the latest week to the top sales of the previous week. I am trying to get a table that looks like : Product | Rank | Rank previous week Table | 1 | 2 Chair | 2 | 1 index=sales earliest=-2w latest=-w | stats count as Sales by Product| sort -Sales | table Product | streamstats count as Rank I succeeded in having the latest rank or the previous rank (see query above) but I don't see how I can combine them. Do you know how I could do this ? Thanks ! ... View more

Hi ! I am trying to modify the legend generated by the timewrap command. I saw that we could slightly change it with the parameter "series" but it's not really giving me what I want. Let's say I want to have a sum of prices from this request : index=sandbox earliest=-13d | timechart sum(prices) as "Sum of the prices" span=d | timewrap 1w series=relative The legend will be Sum of the prices_1week_before and Sum of the prices_latest_week . I would like to have something like Sum of the prices for the week before and Sum of the prices for the latest week . How can I get this ? Thanks ! ... View more