Interesting field Showing values count when I click its get automatically added search  its showing 0 events and if i use * then its work if i search for particular string then its showing 0 events   index=abc   Index=abdc cluster_name="abc"   (not working)  Index=abdc cluster_name="*"      Showing Result  ... View more

I want to all saved search like Alerts or Reports which is Scheduled but after running the query the there is no event  or no data  ... View more

I have date field which is showing date I want only last date of every month and i want filter only last six month if i choose in time picker last 6 moth it shows last date of month like 2019-05-31 23:59:59.999999+00 2019-04-30 23:59:59.999999+00 2019-03-31 23:59:59.999999+00 2019-02-28 23:59:59.999999+00 2019-01-31 23:59:59.999999+00 2018-12-31 23:59:59.999999+00 how it will possible please suggest me ... View more

Now 6/1/19 12:31:03.763 AM 2019-06-01 00:31:03.763, wanted 6/1/19 12:31:03.763 AM 2019-06-01 00:31:03.763 ... View more

tw_scm_test_results(snapshotDate=""$tokMaxDate$"", policyFamily=""$prmPolicyFamily$"", policyName=""$prmPolicyName$"", policyPlatform=""$prmPolicyPlatform$"", policyTest=""$prmPolicyTest$"", dataSource=""$prmDataSource$"", assetName="*", waiverUnknownHandling=""$prmWaiverUnknownHandling$"", testResult="*" ) tw_scm_test_results_tag_filter(tagSet=""$prmTagSet$"", tagValue=""$prmTagValue$"") ... View more

FIELD -TimeReceived: 2019-05-09T05:29:03.000Z this is my prpos .conf xyz SHOULD_LINEMERGE=false NO_BINARY_CHECK=true LINE_BREAKER = ([\r\n]+) CHARSET=UTF-8 KV_MODE=json TRUNCATE=999999 DATETIME_CONFIG = ... View more

below i need to add a legend in pie chart so please tell me what would be the code pie none all ellipsisNone true false ... View more

in below query its showing time picker data or time as per time picker. but i want if i select last 30 days in time picker it should show date of last 30 days ,if i select date range it should be show same date in my coloum and if select last last month it should be showing date on start date tsest _time <input type="time" token="timepicker"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <table> <search> <query>| makeresults |eval start_date="$timepicker.earliest$", end_date="$timepicker.latest$"|table start_date,end_date</query> <earliest>$timepicker.earliest$</earliest> <latest>$timepicker.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> ... View more

see the below image , how to save the highlighted section of the search in a saved search.. So that I can reuse that ... View more