Hi, here is the description. In a dashboard there is time range picker with its token time_tkn and 2 dropdowns. The first dropdown is connected with the time_tkn (index=index1 host=host1 earliest="$time_tkn.earliest$" latest="$time_tkn.latest$"). Output is a varchar list. This dropdown has its token (dropdown1_tkn). Example: selected value from the dropdown is Text1 Text2. So dropdown1_tkn=”Text1 Text2” There is lookup table table1, which has these important columns: workplace, orderId, start_date, start_time, end_date, end_time. start_date, end_date have this format: %d.%m.%Y. start_time, end_time have this format: %H:%M:%S Output in dropdown should be a list of orderId. Here is condition for the list of the dropdown2: to select every orderId from lookuptable, where workplace=$dropdown1_tkn$ and start_date+start_time>=$time_tkn.earliest$ AND end_date+end_time<=$time_tkn_latest$ Can anybody help, please? ... View more

Hi, problem is very simple index=myIndex How to show events from specific time range: previous Thursday 12:00 - next Thursday 10:00. E.g.: on Wednesday 10:00 should be searched data from previous Thursday 12:00 till now() or next Thursday 10:00. ... View more

Hi, I have a lookupTable id.csv with 3 columns: ID, limit, time ID limit time 1111 20000 16.04.2026 2222 20000 16.04.2026 3333 20000 16.04.2026   I have an index=id where is attribute ID_index. UseCase: to have an output table. The alg is: for every ID_index=ID (of the lookUp) count events as cnt from index earliest=time (of the lookUp)and compare it with limit of the lookUp table for this ID. If cnt is more than limit, write it in to the output table.   ID cnt limit msg 1111 20001 20000 limit outreached 2222 30000 20000 limit outreached   Any idea, please? ... View more

Hi, problem is very simple. A dashboard without time picker and hard defined  <earliest>-7d@h</earliest> <latest>now</latest> for every search. How to display after every refresh/start of the dashboard in a title values of -7d@h and now() ? E.g. at 10am 30.03.2026 I open the dash and the title will be: This dashoboard shows analysis in this time range: 20.03.2026 10:00 till 30.03.2026 10:00. thx ... View more

Hi, I have 2 simple queries: | makeresults | eval tmp1=1, tmp2=1 | table _time, tmp1, tmp2   | makeresults | eval tmp1=12, tmp2=12 | table _time, tmp1, tmp2 Is it possible to send these results as column charts in 1 pdf file per email? ... View more

Hi, the problem is very simple. Idea: to send automatically the chart as an attachment via email using saved search or another method. Simple query: | makeresults | eval tmp1=1, tmp2=1 | table _time, tmp1, tmp2 Here is the url: ./search?earliest=%40d&latest=now&q=%7C%20makeresults%0A%7C%20eval%20tmp1%3D1%2C%20tmp2%3D1%0A%7C%20table%20_time%2C%20tmp1%2C%20tmp2&display.page.search.mode=smart&dispatch.sample_ratio=1&display.general.type=visualizations&display.page.search.tab=visualizations&display.visualizations.charting.chart=column&sid=1773075111.8839884 Url shows simple column chart. How to execute this query with saved search and send per email this column chart? ... View more