I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records. eg. |makeresults |eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",") I want to get the value 3 from fieldA ... View more

I am trying to create a line chart and it has date as x-axis and some category as y axis. I could see "Mon Jul 8" on x axis but the data point is not above it, it is showing data point on left of it i.e for Jul 7. PFB the screenshot I want the data point for the label below. ... View more