I have solved in this way, thanks a lot index = "almp_step" | eval timestamp = strftime(_time, "%b-%d-%Y %H:%M") | eval ReqID = "ID"+'RequirementID' | eval TestCase = "TC "+'TestName' | eval ExecDT=if(isnull(Executiondate), "-", Executiondate) | eval Executiondate=strptime(if(isnull(Executiondate),strftime(now(), "%d/%m/%y"),Executiondate), "%d/%m/%y") | search ("Release" = "Week - WAVE 5D") AND ("IntegrationTestList" = "") AND ("RequirementID" = "") AND (timestamp = "Mar-19-2019 15:00") | stats count as Total count(eval('ActualStatus'="N/A")) as NA count(eval('ActualStatus'="Passed")) as Passed count(eval('ActualStatus'="Waiting Previous Step")) as Waiting count(eval('ActualStatus'="To Do")) as ToDo count(eval('ActualStatus'="Blocked")) as Blocked count(eval('ActualStatus'="Failed")) as Failed count(eval('ActualStatus'="Not Completed")) as NotCompleted by "Release" "ReqID" "IntegrationTestList" "TestCase" | eval "TC Status" = case ( (Passed + NA) == Total, "Completed", Failed>0, "Failed", Blocked>0, "Blocked", Passed>0, "Progress", (ToDo + Waiting == Total), "ToStart", (Waiting + NA + NotCompleted) == Total, "OnHold" ) | stats count as "#TC" by "TC Status" | append [ | makeresults | fields - _time | eval data="status=\"Blocked\",count=0;status=\"Completed\",count=0;status=\"Failed\",count=0;status=\"OnHold\",count=0;status=\"Progress\",count=0;status=\"ToStart\",count=0" | makemv data delim=";" | mvexpand data | rename data as _raw | kv | rename status as "TC Status" | stats sum(count) as "#TC" by "TC Status"] | stats sum("#TC") as "#TC" by "TC Status" | sort "TC Status" | eval TCStatus = '#TC' + " " + 'TC Status' | fields TCStatus, "#TC" ... View more

Hi, in my case label is dinamically because contain also the %, for example: 30,1% Completed 23% InProgress But these values are dinamic so change everytime, how we can manage this scenario? ... View more

Hi, my label is dynamic, so contain Blocked but also other information (for example the % of data) Please let me know Thanks, A ... View more

Label is created dinamically using %, we can have 5 different slices with dynamic label. There is a way to set a static color for 5 different slices associating to each status also used in dynamic label (for example ToStart). Below the query used index = "almp_step" | eval timestamp = strftime(_time, "%b-%d-%Y %H:%M") | eval ReqID = "ID"+'RequirementID' | eval TestCase = "TC "+'TestName' | eval ExecDT=if(isnull(Executiondate), "-", Executiondate) | eval Executiondate=strptime(if(isnull(Executiondate),strftime(now(), "%d/%m/%y"),Executiondate), "%d/%m/%y") | search ("Release" = "") AND ("IntegrationTestList" = "") AND ("RequirementID" = "*") AND (timestamp = "Mar-18-2019 14:00") | stats count as Total count(eval('ActualStatus'="N/A")) as NA count(eval('ActualStatus'="Passed")) as Passed count(eval('ActualStatus'="Waiting Previous Step")) as Waiting count(eval('ActualStatus'="To Do")) as ToDo count(eval('ActualStatus'="Blocked")) as Blocked count(eval('ActualStatus'="Failed")) as Failed count(eval('ActualStatus'="Not Completed")) as NotCompleted by "Release" "ReqID" "IntegrationTestList" "TestCase" | eval "TC Status" = case ( (Passed + NA) == Total, "Completed", Failed>0, "Failed", Blocked>0, "Blocked", Passed>0, "Progress", (ToDo + Waiting == Total), "ToStart", (Waiting + NA + NotCompleted) == Total, "OnHold" ) | stats count by "TC Status" | sort "TC Status" | eval TCStatus = count + " " + 'TC Status' | fields TCStatus, count I can't attach the print because i don't have the grant ... View more

Label is created dinamically using %, we can have 5 different slices with dynamic label. There is a way to set a static color for 5 different slices associating to each status also used in dynamic label (for example ToStart). Below the query used index = "almp_step" | eval timestamp = strftime(_time, "%b-%d-%Y %H:%M") | eval ReqID = "ID"+'RequirementID' | eval TestCase = "TC "+'TestName' | eval ExecDT=if(isnull(Executiondate), "-", Executiondate) | eval Executiondate=strptime(if(isnull(Executiondate),strftime(now(), "%d/%m/%y"),Executiondate), "%d/%m/%y") | search ("Release" = "") AND ("IntegrationTestList" = "") AND ("RequirementID" = "*") AND (timestamp = "Mar-18-2019 14:00") | stats count as Total count(eval('ActualStatus'="N/A")) as NA count(eval('ActualStatus'="Passed")) as Passed count(eval('ActualStatus'="Waiting Previous Step")) as Waiting count(eval('ActualStatus'="To Do")) as ToDo count(eval('ActualStatus'="Blocked")) as Blocked count(eval('ActualStatus'="Failed")) as Failed count(eval('ActualStatus'="Not Completed")) as NotCompleted by "Release" "ReqID" "IntegrationTestList" "TestCase" | eval "TC Status" = case ( (Passed + NA) == Total, "Completed", Failed>0, "Failed", Blocked>0, "Blocked", Passed>0, "Progress", (ToDo + Waiting == Total), "ToStart", (Waiting + NA + NotCompleted) == Total, "OnHold" ) | stats count by "TC Status" | sort "TC Status" | eval TCStatus = count + " " + 'TC Status' | fields TCStatus, count ... View more

I have this problem always in production env, there is some condition on the index? ... View more

Hi Giuseppe, thanks for the reply. I use the same query also in test environment and I don't have this warning. What you mean about the below point? Did you used default parameter for ingestion or do you used special values? ... View more

Hi Giuseppe, I execute this query, the warning appears on the dashboard. index=devops source="DOO_DEPLOY_HST" |dedup ID | search STATUS="COMPLETED" $SYSTEM$ RELEASE_WIND=$RELEASE_WIND$ $RELEASE_MODE$ $ENV_DEPLOY$ | timechart span=1d count by STATUS ... View more

Hi Giuseppe, how can verify the number executable searches for my user? Thanks, Aniello ... View more

OK clear but if run this command it doesn't return anything: sourcetype="import_clone_tot_clob" REQUEST_TYPE = "Attivazione" [| tstats latest(_time) as LatestTime where sourcetype="import_clone_tot_clob"] If I run the following command separately works correctly: ----> sourcetype="import_clone_tot_clob" REQUEST_TYPE = "Attivazione" ---->| tstats latest(_time) as LatestTime where sourcetype="import_clone_tot_clob" ... View more

The problem is to add this condition (earliest=[whatever that evaluates to]) I have to change every day. my search works every day and recover the last day execution ... View more

I add that all dashboards are updated, there is only one dashboard that has been updated only in default folder and not in local. But the problem is that only this dashboard in Prod env is present in this folder (local), the other are present in default folder. Why? ... View more

Hi, in your search how can I add the filter time?Always using add input? ... View more