Hello, Yesterday we upgraded to v2.0 to take advantage of new features. Prior to this, there were no problems, but now we're only seeing lookups from 4 of our many apps (about 31 lookups instead of ~150). I'm hoping this is just a simple fix that's obvious and I'm overlooking. Any ideas? Thanks ... View more

Hello, I have a pie chart in a dashboard that, when loaded in its own search, looks like this (correct): http://puu.sh/jYFMd/0d02be5455.png. Prior to this morning, every time it's loaded on the dashboard, it's been fine. However, now it looks like this (broken): http://puu.sh/jYFQJ/94ffcab70c.png. Has anyone experienced this issue / know what's going on? Thanks for your help! ... View more

Hello, I have a query that does 5 searches. A recent search, and four sub searches on the same exact data from 1-4 weeks ago, then compares the 4 week avg to the recent data. The subsearches join on weekday and hour so need to be exactly 7 days prior to the original earliest/latest. Here's a hard-coded example: index="foo" sourcetype="bar" earliest="11/05/2014:12:00:00" latest="11/11/2014:12:00:00" | bucket _time span=1h | stats count as current_joins by _time | eval joiner = strftime(_time,"%w:%H") | join joiner [ search index="foo" sourcetype="bar" earliest="10/29/2014:12:00:00" latest="11/04/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/22/2014:12:00:00" latest="10/28/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as two_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, two_week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/15/2014:12:00:00" latest="10/21/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as three_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, three_week_ago_joins ] | join joiner [ search index="foo" sourcetype="bar" earliest="10/08/2014:12:00:00" latest="10/14/2014:12:00:00" |lookup siteid_lookup siteid as site OUTPUT name | fields _time site | bucket _time span=1h | stats count as four_week_ago_joins by _time | eval joiner = strftime(_time,"%w:%H") | fields joiner, four_week_ago_joins ] | eval four_week_combined_avg = round((four_week_ago_joins+three_week_ago_joins+two_week_ago_joins+week_ago_joins)/4,2) | eval change_pct = round(((current_joins-four_week_combined_avg)/four_week_combined_avg)*100,2) I've found this analysis to be very useful in analyzing business metrics, especially around release management. I'm trying to figure out a way to create a dashboard where you only need to select an earliest and/or latest time, then the subsearches will adjust accordingly. Any advice would be greatly appreciated, thanks! ... View more