Hi, I have this search: host="myhost.com" NOT source=*access_log* AND "SearchA" | timechart span=1d dc(App) as NotAssigned | eval NotAssigned=NotAssigned+0 | appendcols [search SearchB | timechart span=1d sum(Count) as Assigned ] | eval Time=strftime(_time, "%d-%m") |table Time, Assigned, NotAssigned This seems to work ok, but sometimes one of those variables is shown with no time for some events, and I don't know why. This is the case: When I made the searches individually, this was displayed correctly. But in some moments, it looks like there are some _time values missing. Like in the attached image, today is 26-08, but the table is showing until 25-08, and one of the variables was displaced a couple of days. Do you know how to fix it? ... ... View more

Hi, I hope you can help me with this, I have 2 search results and I want to get the difference between both in the same search to display it in a table panel. So.. search events 1: New apps retrieved | stats values(Count) as Apps_retrieved | Table _time, Apps_retrieved search events 2: Apps_Assignment: apps generated in | stats values(Count) as Apps_generated | Table _time, Apps_generated So, basically what I need is to get: {(search events 1) - (search events 2)} | timechart span=1h count or some way to expose this difference in 1h intervals. Thanks in advance, ... View more