Hi all, I am trying to create a dashboard or a graph where I want to show the ticket status by weekly. I am uploading a csv file in which I have 3 fields 1) Weeks --> Values are week1, week2, week3 and week4 2) Status --> Closed and Pending 3) Team_names --> Team1, Team2 and Team3 I want to create a bar graph which shows weekly wise along with pending and closed in a single bar for each team. I tried the below query but it is not showing in a single bar | inputlookup July_2014.csv | stats count by status, WEEKs, team_name ... View more

I am trying to create a search where sub-search returns 2 fields. Field 1) list of servers 2) time. now for example., I get 3 results from the sub-search as host1, host2 and host3 for server field along with that I get 3 time which is host1_time, host2_time and host3_time. I want to search (host1 from host1_time to host1_time + 8 hours) and (host2 from host2_time to host2_time + 8 hours) and (host3 from host3_time to host3_time + 8 hours) I tried many type of search but it is not working. Sub-search can return n value for server field and n value for time field. Any help would be appreciated. ... View more

Hi, I am trying to search a query where I need a _time value from sub search to the main search and in main search earliest should be the _time which I get from the sub search. I tried to give it as a variable but it dint work. sourcetype=dg earliest=_time [search earliest=-7d sourcetype=dg (src_file_name="usb#flash disk" OR src_file_name="usb#mass storage") | dedup src_host, src_file_name | return src_host, _time] I also tried the below query but it dint work sourcetype=dg earliest=$_time [search earliest=-7d sourcetype=dg (src_file_name="usb#flash disk" OR src_file_name="usb#mass storage") | dedup src_host, src_file_name | return src_host, $_time] Any help would be appreciated. ... View more