What you would require to do is extract the base url from the url field and count on them like this: yourQuery to return field url | rex field=url "^(?<baseUrl>[^\/\s]+)" | stats count by baseUrl See the extraction of baseUrl from url here ... View more

It depends on what function do you want to use to round of : floor , ceil etc. and then rounding off before you convert via tostring . Something like this: my search |eval field_in_hhmmss=tostring(ceil(avgDurationPerpid), "duration") | table id field_in_hhmmss OR my search |eval field_in_hhmmss=tostring(floor(avgDurationPerpid), "duration") | table id field_in_hhmmss ... View more

Let me have a stab at it, with something similar I achieved where I didn't need a lookup as I generated the codes based on the fields which appeared in events. My data had events where one "Name" field value only had one "Code" field value. i.e. Name1 always had Code1 ( Name RED always had Code #FF00FF) in all the events. : Oct 31 2016 00:00:00; Name= RED; Code= #FF00FF; IP=10.120.10.22 Oct 31 2016 00:00:01; Name= GREEN; Code= #00FF00; IP=110.120.10.22 Oct 31 2016 00:00:02; Name= BLUE; Code= #0000FF; IP=210.120.10.22 Oct 31 2016 00:00:03; Name= YELLOW; Code= #FFFF00; IP=180.120.10.22 Based on above events this is what I followed: 1) Create a hidden drop down input element. 2) In this dropdown's dynamic query create a string value, I called it valuesP , that will save all colourNames and colourCodes. These Name and Codes will be picked up from data field values of "Name" and "Code". 3) Format this valuesP string to suit the charting.fieldColors option, eg. for me the codes in valuesP were coming in #pppppp format but charting.fieldColors required colour in 0xpppppp format. (Might not be applicable for you) 4) Field valuesP was table(d) in dropdown, and set for fieldForLabel and fieldForVlaue . This sets the dropdown token which will be used to display colours. I called my dropdown token as colourToken . 5) Use the colourToken token in the charting.fieldColors option of chart. Here is the dropdown code which was used. <input type="dropdown" token="colourToken" searchWhenChanged="true" depends="$hideToken$"> <label>Hidden DropDown</label> <search> <query>... | eval colourCode="\"".Name."\": ".Code | stats values(colourCode) as valuesP | mvcombine valuesP | rex field=valuesP mode=sed "s/ \"/, \"/g s/\#/0x/g" | table valuesP </query> </search> <fieldForLabel>valuesP</fieldForLabel> <fieldForValue>valuesP</fieldForValue> <selectFirstChoice>true</selectFirstChoice> </input> Things to note in dropdown code: - A dummy token called $hideToken$ was used to keep dropdown hidden all the time as this token will never be set. - Set the selectFirstChoice = true (just for safety, even though only one string is tabled in query, might not be required though) - Dropdown token colourToken was used in the charting option of pie chart as: <option name="charting.fieldColors">{$colourToken$}</option> NOTE - My base query that was used to create the pie chart created fields called "RED", "YELLOW" and so on (a static part which requires me to be aware of what colours will be coming in my data) as charting.fieldColors works on fields. Here was my query to plot pie chart: ...| stats count(eval(Name=="RED")) as RED, count(eval(Name=="BLUE")) as BLUE, count(eval(Name=="YELLOW")) as YELLOW, count(eval(Name=="GREEN")) as GREEN Hope it helps 🙂 ... View more

your Base query to generate place , mag, depth | eval mag=if(place="7km W of Cobb, California" OR place="1km SE of Loma Linda, California", mag+depth, mag) | eval depth=if(place="7km W of Cobb, California" OR place="1km SE of Loma Linda, California", 0, depth) | table place, mag, depth ... View more

If all four fields are already extracted as date, device, daily_avg, threshold then all you need to do is your query to return date, device, daily_avg, threshold | table device, daily_avg, threshold, date If date is not extracted then you can use _time your query to return device, daily_avg, threshold | eval date=strftime(_time, "%Y-%m-%d") | table device, daily_avg, threshold , date If the fields are not already extracted then extract them first as below and then table: your query to return events |rex "(?<date>\d{4}\/\d{2}\/\d{2})\s.*Device\=(?<device>[\S]+)\s.*Daily_AVG\=(?<dailyAvg>[\S]+)\s*Threshold\=(?<threshold>[\S]+)\s*" | table device, dailyAvg, threshold , date | fillnull value="NULL" | search device!="NULL" AND dailyAvg!="NULL" AND threshold!="NULL" AND date!="NULL" Updated the fillnull piece as per comments See extraction here ... View more