Hi, I have a lookupTable id.csv with 3 columns: ID, limit, time ID limit time 1111 20000 16.04.2026 2222 20000 16.04.2026 3333 20000 16.04.2026   I have an index=id where is attribute ID_index. UseCase: to have an output table. The alg is: for every ID_index=ID (of the lookUp) count events as cnt from index earliest=time (of the lookUp)and compare it with limit of the lookUp table for this ID. If cnt is more than limit, write it in to the output table.   ID cnt limit msg 1111 20001 20000 limit outreached 2222 30000 20000 limit outreached   Any idea, please? ... View more

Hi, problem is very simple. A dashboard without time picker and hard defined  <earliest>-7d@h</earliest> <latest>now</latest> for every search. How to display after every refresh/start of the dashboard in a title values of -7d@h and now() ? E.g. at 10am 30.03.2026 I open the dash and the title will be: This dashoboard shows analysis in this time range: 20.03.2026 10:00 till 30.03.2026 10:00. thx ... View more

Hi, I have 2 simple queries: | makeresults | eval tmp1=1, tmp2=1 | table _time, tmp1, tmp2   | makeresults | eval tmp1=12, tmp2=12 | table _time, tmp1, tmp2 Is it possible to send these results as column charts in 1 pdf file per email? ... View more

Hi, the problem is very simple. Idea: to send automatically the chart as an attachment via email using saved search or another method. Simple query: | makeresults | eval tmp1=1, tmp2=1 | table _time, tmp1, tmp2 Here is the url: ./search?earliest=%40d&latest=now&q=%7C%20makeresults%0A%7C%20eval%20tmp1%3D1%2C%20tmp2%3D1%0A%7C%20table%20_time%2C%20tmp1%2C%20tmp2&display.page.search.mode=smart&dispatch.sample_ratio=1&display.general.type=visualizations&display.page.search.tab=visualizations&display.visualizations.charting.chart=column&sid=1773075111.8839884 Url shows simple column chart. How to execute this query with saved search and send per email this column chart? ... View more

Hi, the problem is very easy. I have 2 variables: timestamp: _time flow of nitrogen: flow [m^3/h] On the dashboard the user can use the time picker as he wish. Samples of flow are nonlinear measured. There is no linear discrete time. Goal: to have a number of consumption [m^3] of the nitrogen in selected time range. Example: If the time range is exactly 1h, and the flow=6 only, it can be used the avg fcn and the consumption=6. If the value of flow varies, and the time range also, I don’t think, the avg fcn can be used. I’m looking for something like integral. Can anybody help, please? ... View more

Hi, here is the description of the status quo. There is multiselect element defined by a token tkn1. Output variable is “value”. The default and initial value is defined as All. All has its static value “*”. There are 2 items to be picked up. “1”, “2”. The syntax of logic using pick up fcn is: token prefix: value IN ( token suffix: ) token value prefix: “”” token value suffix: ““” delimiter: “,” So if user choose these 2 values except All, the token has its value: value IN ("1","2"). If I use in the query where condition like this: | where $tkn1$ and these 2 items are picked up, everything is ok. Question: if the user choose only All, not working: | where value (“*”) Any idea, how to handle with it, please? ... View more

Hi, any help, pls? Here is the description: lookupTable(links.csv):columnName(Link) lookupTable(links.csv):columnValue(https://www.google.com) in the dashboard Table Visu: | inputlookup links.csv | head 1 | table Link how to click on the tableCell (https://www.google.com) and new browser window with the https://www.google.com will be opened?   ... View more

Hi, any help, please? Here is the code | makeresults | eval tmp_1=1 | eval tmp_2="" | eval tmp_3=3 | eval tmp="" | foreach tmp_* [| eval tmp = tmp ."|".if(isnotnull(<<FIELD>>),<<FIELD>>,"")] | eval tmp=substr(tmp, 2) | table tmp Output is: tmp=1||3 I would like to have output tmp="1|3", it means how to skip the step in foreach, if the <<FIELD>> is null? ... View more