Hello Thanks for your reply. I have few heavy dashboards that most of them are using the same base search so i thought that summary index can be the right way to reduce the running time. As I understood from documentation, I need to create a report that running the base search and schedule it to run once a day and send the result to summary index, is it right ? If yes, should I run the dashboards with the summary index and the "regular" index ? also, If the report results are saved in summary index, does it mean the logs are saved twice ? once in the "regular" index and once in summary index ? ... View more

Hello It looks good but once im clicking on one of the graphs its shows no results: also, i want to visualize by Level as well ... View more

ok, i found the problem one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing so i guess i configured it wrong what is the right way to configure trellis_pie token ? this is the source: <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <drilldown> <set token="host_exposure_level">$row.category$</set> </drilldown> </chart> ... View more

ok, i found the problem one of the panels that updates the table is trellis_pie and this token is the one that brakes every thing so i guess i configured it wrong what is the right way to configure trellis_pie token ? this is the source: <panel> <chart id="trellis_pie"> <option name="charting.axisTitleX.visibility">collapsed</option> <option name="charting.axisTitleY.visibility">collapsed</option> <option name="charting.axisTitleY2.visibility">collapsed</option> <option name="charting.chart">pie</option> <option name="charting.chart.sliceCollapsingThreshold">0</option> <option name="charting.drilldown">all</option> <option name="charting.legend.placement">none</option> <option name="refresh.display">progressbar</option> <option name="trellis.enabled">1</option> <drilldown> <set token="host_exposure_level">$row.category$</set> </drilldown> </chart> </panel> ... View more

Hello i've tried to add * as the initial value but its not working in default initial value ignored once default value is configured.   ... View more

Hello Each filter have default value "*" this is an example for the source of 2 filters : <input type="multiselect" token="Account_Label_Azure"> <label>Account Label Azure</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Account_Label_Azure</fieldForLabel> <fieldForValue>Account_Label_Azure</fieldForValue> <search> <query>index=report Account_Label_Azure=*</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="multiselect" token="Account_Label_VMware"> <label>Account Label VMware</label> <choice value="*">ALL</choice> <default>*</default> <fieldForLabel>Account_Label_VMware</fieldForLabel> <fieldForValue>Account_Label_VMware</fieldForValue> <search> <query>index=report Account_Label_VMware=*</query> <earliest>-24h@h</earliest> <latest>now</latest> </search>   and this is the source of the table  <table> <search> <query>index="report" Category__Severities_of_Patches="$host1$" OR Category__Categories_of_Patches="$host2$" OR Category__Sources_of_Patches="$host3$" OR exposure_level=$host_exposure_level$ OR Computer_Name="$computer_name$" OR Account_Label_Azure="$Account_Label_Azure$" OR Account_Label_VMware="$Account_Label_VMware$" OR BigFix_Groups="$BigFix_Groups$" OR Category__Sources_of_Patches="$Category__Sources_of_Patches$" OR Custom_Attributes="$Custom_Attributes$" OR Custom_Site_Names="$Custom_Site_Names$" OR IP_Address="$IP_Address$" OR Operating_System="$Operating_System$" OR OS="$OS$" OR Pending_Restart="$Pending_Restart$" OR Power_State_VMware="$Power_State_VMware$" OR Provider_Name="$Provider_Name$" OR Relay="$Relay$" OR State_Azure="$State_Azure$" OR VM_Region="$VM_Region$" OR Tags_Azure___cost_environment=$Tags_Azure___cost_environment$ OR Tags_Azure___cost_servicegroup=$Tags_Azure___cost_servicegroup$ OR Tags_Azure___cost_team=$Tags_Azure___cost_team$ OR Custom_Attributes=$Custom_Attributes$ | table Computer_ID Computer_Name Account_Label_VMware Account_Label_Azure Provider_Name OS Relay VMware_Tags Tags_Azure Custom_Site_Names Pending_Restart Custom_Attributes Last_Report_Time Last_Updated Free_Space_on_System_Drive_(GB) Power_State_VMware State_Azure BigFix_Groups Category__Names_of_Patches Category__Severities_of_Patches Category__Categories_of_Patches Category__Sources_of_Patches Category__CVEs_of_Patches Category__Release_Dates_of_Patches</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> ... View more

solved it by changing to stats. thanks ... View more

so what sould i do ? replacing it with timechart returns also no results ... View more

Well, ive changed it to this : | eval category=exposure_level | timechart span=1d count(Computer_Name) as totalNumberOfPatches by category but still no results ... View more

Hello Thanks ! it looks good but i still have few issues : i configured this : <style> #trellis_pie div.facets-container div.viz-panel:nth-child(1) g.highcharts-series path { fill: blue !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(2) g.highcharts-series path { fill: yellow !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(3) g.highcharts-series path { fill: red !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(4) g.highcharts-series path { fill: green !important; } #trellis_pie div.facets-container div.viz-panel:nth-child(5) g.highcharts-series path { fill: gray !important; } </style> if i understand correctly, the order of the colors is the order of the conditions in the "case" so, in that case, "High Exposure" supposed to be red but actually its blue, "Low Exposure" supposed to be blue but its yellow and "Medium Exposure" supposed to be yellow but its red, the other two does not shown but it supposed to.  also, i don't see the number of results in the pie, i just see "other" even thought Minimum size set to 0   ... View more

sorry , category = exposure_level ... View more

exactly and will show the number of the count for the specific category ... View more

separate once ... View more

Thanks It looks better I just want to color the pie in different colors so :  "Low Exposure" - blue  "Medium Exposure" - yellow "High Exposure" - red "Compliant" - green <not reported> - gray I couldn't find an option to do it  ... View more

pie chart ... View more

ok, got it, thanks but how can i change it to timechart ? because when im running this : index=clientlogs sourcetype=clientlogs Categories="*networkLog*" "Request.url"="*v3/auth*" Request.url!=*twofactor* "Request.actionUrl"!="*dev*" AND "Request.actionUrl"!="*staging*" | eval SuccessFE=if(('Request.status' IN (201, 207) ),1,0) | eval UserAgent = case(match(UserAgent, ".*ios.*"), "iOS FE",match(UserAgent, ".*android.*"), "Android FE",1=1, "Web FE") | stats count as total sum(SuccessFE) as SuccessFE by UserAgent | eval SuccessRatioFE = (SuccessFE/total)*100 | chart bins=100 values(SuccessRatioFE) over _time by UserAgent I get no results while if im running a table i see results also, i cannot add the NOT filter I need inside the if statement : NOT "Request.data.twoFactor.otp.expiresInMs"="*"   ... View more

Hello Thanks for you detailed answer What im trying to achieve is to calculate the ration between the attempts and the success Actually I've searched some details regarding the base search and how to use it in other parts of the query (also i want to use base search in other panel at the same dashboard) and i couldn't find any information I will really appreciate if you will be able to correct my query as im not familiar with different way to achieve the same. P.S - at the end, the final query should append the results from this query and results from similar query but for the BE part so the final query will be larger and heavier  ... View more

ok, so what is your suggestion ? how can i achieve my goal ? ... View more