The thread is even older now, but I also found you need to specify  ` 'alert.suppress' : 0 ` when posting to ` /servicesNS/{owner}/{app}/saved/searches/ ` to make sure it's an alert and not a report. In total, I specified at least the below parameters to create an alert   { 'is_scheduled': 1, 'cron_schedule': '09-59/10 * * * *', 'alert_comparator': 'greater than', 'alert_threshold': 5, 'alert_type': 'number of events', 'alert.suppress': 0, }     ... View more

Can you be more specific about what you changed? ... View more

Awesome examples, thanks! ... View more

I looked way too hard to find this. Thank you for your answer! ... View more

The simplest answer is to just make a | table val1 val2 . Then switch to the Visualization tab and select a visualization like Line Chart , where your table will be graphed with val1 on the x axis, and val2 on the y axis. If you wish to graph more than 2 values, add them to your table also. Columns 2 and beyond will be graphed as separate series against the first column. This behavior is much like you'd expect making a line chart in excel. ... View more