Hello all, I have a report that searches for differents time range like Year to now, Month to now, Last 5 days and last 24 hrs. The current search is: search index | stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total" | eval "Date" = "Last 24 hrs" | append [ search "same search index" earliest=-5d@d latest=now() | stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total" | eval "Date" = "Last 5 days"] | append [ search "same search index" earliest=-0mon@mon latest=now() | stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total" | eval "Date" = "Month to now"] | append [ search "same search index" earliest=-0year@year latest=now() | stats sum(FAIL) as "Failures", sum(PASS) as "Passed", sum(TOTAL) as "Total", earliest(_time) as "Date" | convert timeformat="%m/%d/%Y" ctime("Date") as "Date" | eval "Date" = "Year to now - ".'Date'] | table "Date", "Failures", "Passed", "Total" The final result is a table with 4 rows in it. Containing Last 24 hours, Last 5 days, Month to now and Year to now results. So the problem that I'm currently facing is sometimes the Year to now results, returns a different Date like 01/27/2020. It's supposed to be the first day of the current year. The Job Inspect tells me that the append command is consuming a lot of time to be completed. Is it possible to do the longest search (Year to now) and have multiples stats commands by different time range to get the final result or a way to improve this search? Thanks for all your help. ... View more

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search. | gentimes start=$field1.earliest$ increment=3h | convert timeformat="%Y/%m/%d - %H" ctime(starttime) | rename starttime as date | table date I tried to search inside the start argument but It throws an error: [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and 'increment' values The full query (with gentimes error): base search | append [| gentimes start= [search "base search" | tail 1 | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt | eval firstEvent = dt | return $firstEvent] increment=3h | convert timeformat="%Y/%m/%d - %H" ctime(starttime) | rename starttime as defaultDate | table defaultDate] Thanks. ... View more