this answer is wrong. you are trying to strftime from milliseconds. although the result will show readable format, the values are invalid. ... View more

another option works better: base search | chart dc(index) by fieldA fieldB useother=f limit=0 | transpose header_field=fieldA column_name=fieldB 100 | sort fieldB | transpose column_name=fieldA header_field=fieldb 100 ... View more

I had the same issue after chart command, I fixed it by adding leading 0 to my values: search here | eval data=if(len(data)=1,"0"+data,data) | chart count by fielda data ... View more

one of my DB connection also got stuck, I created a new one for the same connection, and deleted the old one. ... View more

NVM, I found the answer. I needed to set maxsearch ... View more

Thank @kamlesh_vaghela this works perfectly. but how do I change limit=0? I am only getting 10 results in my statistics table. ... View more

the only way I got around this issue is by moving my data into another index: after I ran this "all time" I scheduled a report with the search below, to update my "clean" index every hour for the last hour. index=myxml sourcetype=toomanyfields | table clean_field1 clean_field2 clean_field3 | collect index=clean sourcetype=clean_data ... View more

glad I was able to help! ... View more

If I understand your question correctly, I think this is what you need: index=smeindex sourcetype IN (A,B,C) | bucket _time span=10m | stats values(field1) as field1 values(field2) as field2 values(field3) as field3 by _time then you can add any condition, like: |where field1=field2 ... View more