Hi Vatsal, Thanks for your quick answer. That shows an interesting approach: to link a search to another one. But I don't see that our task can be solved simply with such linked searches. Let me explain our goal: There are three search results on our dashboard. 1. The first one takes its input from XML files in subfolders of a given folder and shows the result in a table in increasing time order. (This search contains installation results overview.) Then the user clicks on a column in this table. The drill down operation takes the subfolder of the selected item (installation duration and overall result) and initiates two other searches in that subfolder. In addition the clicked item shall be shown in a brighter color. 2-3. These searches run in the above mentioned subfolder and take their input from different XML files and show their contents (result of installation steps and result of system integration tests). So far so good. Now we have to make the drill down operation on the last item automatic: when the uppermost chart is displayed then the detailed results of the last item shall be shown without any user interaction in the lower two charts. Now you can see why did I write that if progress events contained each result items fields then this task could be - relatively - easily accomplished. With best regards, fjp2485 ... View more

I've found a solution: the default value of the dat/time picker has to be Previous week. See the code below. In addition in its change section it contains code which converts the earliest and latest values to human readable form (earliest_str and latest_str). <input type="time" token="range" searchWhenChanged="true"> <label>Set Date/Time Range</label> <default>Previous week</default> <change> <eval token="earliest_tok">if(isnum($range.earliest$), $range.earliest$, relative_time(now(), $range.earliest$))</eval> <eval token="latest_tok">if(isnull($range.latest$), now(), if(isnum($range.latest$), $range.latest$, relative_time(now(), $range.latest$)))</eval> <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval> <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval> </change> </input> In order to have right earliest_str and latest_str just after opening the dashboard we have to initialize them in the init section of the dashboard: <init> <eval token="earliest_tok">relative_time(now(), "-7d@w0")</eval> <eval token="latest_tok">relative_time(now(), "@w0")</eval> <eval token="earliest_str">strftime($earliest_tok$, "%Y.%m.%d")</eval> <eval token="latest_str">strftime($latest_tok$ - 1, "%Y.%m.%d")</eval> </init> In this init section the relative date format is to be used: "-7d@w0" and "@w0" which is equivalent to Previous week default value of the date/time picker input control. ... View more

Hi somesoni2, Thanks for your answer. You probably meant -1w@w0 instead of -7w, isn't it? So the complete input section supposed to look like this: <input type="time" token="range" searchWhenChanged="true"> <label>Set Date/Time Range</label> <default> <earliest>-1w@w0</earliest> <latest>@w0</latest> </default> </input> Unfortunately the displayed text is "Custom time", see screenshot below: But my specification prescribes to show: "Previous week" because this text is more informative for the user. ... View more

Hi nyoung, Many thanks for dealing with my problem so much. I ran the search string you've written: " | metadata type=sources index=sambaresultindex | search source=*GDSNightlyStagingSIT_* " but it didn't retrieve anything. Then I removed the SIT_ suffix to check if installation results files are retrieved. They were also not retrieved. Then I changed index to newsambalogindex and tried again with this search string (to check if installation log files are retrieved): " | metadata type=sources index=newsambalogindex | search source=*GDSNightlyStaging* " This search retrieved all installation log files but the test result files didn't appear again. Then I tried to retrieve only the test result files: " | metadata type=sources index=newsambalogindex | search source=*GDSNightlyStagingSIT_* " and this also didn't retrieve anything - of course. What do I do wrong? ... View more

Hello, I've found an index which works for our query and I've rerun the searches. This search: | tstats count where index=newsambalogindex source=\\bafs1\Builds\DashboardData\GDS\\GDSNightlyStaging resulted 372983 events (so much because there was no filtering for content). This search: | tstats count where index=newsambalogindex source=\\bafs1\Builds\DashboardData\GDS\\GDSNightlyStagingInstallation resulted the same number of events: 372983. This search: | tstats count where index=newsambalogindex source=\\bafs1\Builds\DashboardData\GDS\\GDSNightlyStagingSIT resulted 0. Please tell me if I should run other tests in order to continue investigation. Regards, fjp2485 ... View more

The two kinds of files (i.e. NightyStagingInstallation* and NightlyStagingSIT*) are produced by the same program in the same run of that. In addition the program does not give any special or different permissions to those files. ... View more

I tried to run the tstats, this was its result: Reduced buckets were found in index='sambaresultindex'. Tstats searches are not supported on reduced buckets. Search results will be incorrect. And of course result count was 0. But the same was the result with GDSNightlyStagingInstallation*. ... View more