Hello @matoulas Can you please elaborate the question? One liner isn't seems to define the actual problem 🙂 ... View more

Thanks, jpolvino!  That worked for my timechart! ... View more

Do you have any sample configuration that can guide me how to set it up? Looking forward to your help. Does the setup link below work? This is the only docs that I can find. https://community.splunk.com/t5/All-Apps-and-Add-ons/Setup-Secure-Encrypted-Syslog/m-p/391221   ... View more

One last question? All the column table that were append to it like location, siteid and etc. The result show two data entry for every row. How to make it to not duplicate the data. Thanks in advance! ... View more

Hi, I'm still need your help to apply this drill down in my case. I still don't know how to do it. ... View more

Do that at search time like this: ... | fieldformat _time=strftime(strptime(_time, "%Y-%m-%dT%H:%M:%S%:Z"), "%m/%d/%Y %H:%M:%S") | ... ... View more

Thanks got it to work now. ... View more

Hi Woodcock, Thank you for your help! As the above code, It's working but sorry for the confusing of the plugname in legend. I would like to display dynamic plugname according to plug#... base on JSON code. For example plug1 has plugname of "Outlet_A1", plug12 has plugname of "Meraki", plug10 has a plugname of "Camera" because each plug# has it own plugname base on user assignd. Also when click on individual plugname on the chart for the drill down on the legend I would like to keep the $click.name2$ as plug#...base on the user click for detail instead of plugname. I'm not sure if it's possible, looking forward to your help again! ... View more

Here is my new question. Thanks https://answers.splunk.com/answers/789135/how-do-i-make-a-drill-down-details-from-when-click.html?minQuestionBodyLength=80 ... View more

Below is the main search query index="main" | table sourcetype, siteid, assettag, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1, timestamp, _time | eval Date/Time=_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Date/Time) | eval timestamp=strptime(timestamp, "%Y-%m-%dT%H:%M:%S")| eval timestamp=strftime(timestamp,"%m-%d-%Y %H:%M:%S") | eval release_year = strftime(timestamp_epoc, "%Y") | fillnull value="No Defined" release_year, ats, outletmetering, powerunit, branchcount, plugcount, powerdata{}.branch1{}.current1, powerdata{}.branch1{}.current2, powerdata{}.branch1{}.current3, powerdata{}.branch1{}.current4, powerdata{}.branch1{}.current5, powerdata{}.branch1{}.current6, powerdata{}.branch1{}.current7, powerdata{}.branch1{}.current8, powerdata{}.branch1{}.voltage1, powerdata{}.branch2{}.current1, powerdata{}.branch2{}.current2, powerdata{}.branch2{}.current3, powerdata{}.branch2{}.current4, powerdata{}.branch2{}.current5, powerdata{}.branch2{}.current6, powerdata{}.branch2{}.current7, powerdata{}.branch2{}.current8, powerdata{}.branch2{}.voltage1 | search sourcetype=powerdata ... View more