I'm having an issue where building a glass table in ES for a single value delta ad-hoc search is showing up as N/A, but drilling into it shows me the visualization I want.
My search:
| inputlookup file.csv
| stats count by CASE_CLOSURETIME
| eval NewTime=strptime(CASE_CLOSURETIME,"%Y-%m-%d %H:%M:%S")
| eval _time=NewTime | sort -_time
| timechart count span=1mon
| tail 3
| sort _time
Essentially CASE_CLOSURETIME, is in the same time format as _time, and shows me the results I want with the historical trend as a single value visualization in SPL, but cannot get the same to show up in Glass Tables.
... View more