Hi, I create a simple dashboard from Force Directed, and me interested, how to change color for select value? Example: there is input (token with name $token$ and value "B" or other), and I make this panel... How to set for example red color to "B" if he in $token$ ... View more

Hi, from search ...| timechart count by status maked spikes diagram in dashboard. Example output search: _time 200 300 400 08/09/19 5 8 4 08/07/19 1 3 7 How to get status name (200, 300, 400) and set it in link... <drilldown> <link>/apps/dashboard?form.field=$click.statusname$</link> </drilldown> Note: row not worked, only all or none $click.name$ - return field name '_time' $click.name2$ - return field name 'count' $click.value$ - return value field _time $click.value$ - return value field count ... View more

Hi, I try used it... index=indexname | chart sparkline count by field and this worked, but this not worked | inputlookup lookupname | chart sparkline count by field why and how to fix it? How to I must use sparkline with inputlookup? Thanks ... View more

Hi, how to me use a command split or other command that make two field from one? Example: Im get a token with text "1** or 2**" , I must use this in search | where field=$token$ that get all event with 100-299 number, or using | eval field2=split($token$," or ") and next step using a mvindex(field2, 0) , but this not work. And, how to make an exception if in token is "*". Thanks. ... View more

Hi, How to i must use time range earliest=-24h@h latest=now() in search | inputlookup lookup . I tried to do so | inputlookup lookup | search earliest=-24h@h latest=now() , but this not worked. ... View more