I want to create a dashboard that shows 2 things.  First, it will search over the last 60 minutes for total errors.  sourcetype=blabla  error And, it will look for average errors for the same time period over the past month.  For example, if the search is ran at 14:29, it will show the average errors for 13:30-14:29 for each day over the last month, preferably just weekdays.   So, it will show a stats table with two results.  Total errors for the last 60 minutes, and average errors over that time period for the last month.   Thanks ... View more

I'm wanting to create a visualization that shows the average amount of errors during each minute of the day over a period of time. I can do it for each hour of the day: index=ind sourcetype=sotp "error" | bin _time span=1h | eval date_hour=strftime(_time, "%H") | stats count AS hits first(date_hour) AS date_hour BY _time | stats median(hits) BY date_hour I can also do it for minute of the hour, but not minute of the day. It would be nice to have more granularity. Thanks ... View more

I am searching for error differences between data canters over a selected range of time, displaying in a pie chart. I don't want the pie chart to disappear when the result for both dc's is 0(if only one dc is 0, the chart is still correct). The search and chart work for every result except 0. index=logs "error" | replace "*1dc" with "dc1" in host | replace "*2dc" with "dc2" in host | stats count by host Thanks for the help. Update: got the previous gauge issue resolved with: | appendpipe [stats count | eval NoResult="" | where count=0] Still cant resolve the pie chart issue. ... View more