Hi, Can someone help me? I have the searches below and need to be combine the two to display the expected results: LastWKTotal ThisWKTotal Difference ABC DEF GHI . Searches: index=xxx host=xxx sourcetype=ABC* Agent_NumberOfAgents=* earliest=-14d@d latest=-7d@d | dedup host | stats sum(Agent_NumberOfAgents) as LastWKTotal | appendcols [search index=XXX host=xxx sourcetype=ABC* Agent_NumberOfAgents=* earliest=-7d@d latest=now | dedup host | stats sum(Agent_NumberOfAgents) as ThisWKTotal] | eval Platform="ABC" | eval Difference=ThisWKTotal-LastWKTotal and index=XXX host=XXX sourcetype=ABC* Agent_NumberOfAgents=* earliest=-14d@d latest=-7d@d | dedup host | stats sum(Agent_NumberOfAgents) as LastWKTotal | appendcols [search index=XXX host=XXX sourcetype=ABC* Agent_NumberOfAgents=* earliest=-7d@d latest=now | dedup host | stats sum(Agent_NumberOfAgents) as ThisWKTotal ] | eval Platform="DEF" | eval Difference=ThisWKTotal-LastWKTotal Thanks in Advance ... View more

I am currently running a single hidden search to power all the graphs on my dashboard. The time range for the base search is 3 hours. <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="savedSearch">Search Base</param> The PostProcess then does another search to filter the results, which also works correctly. However when the time chart is created the MIN & MAX Time Range is changed to first/last seen events, when I need it to stay as 3 Hours. It works correctly if I run the search manually, is there something I'm missing? <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1"> <param name="search"> search page="www.homepage.com" | timechart span="5m" count by Status_Code | fillnull value=0 </param> <module name="HiddenChartFormatter"> <param name="chart">bar</param> <param name="charting.axisY.minimumNumber"> </param> <param name="charting.axisY.maximumNumber"> </param> <param name="charting.chart.axisX.includeZero">true</param> <param name="charting.chart.nullValueMode">zero</param> <param name="charting.legend.labels">[500,404,200]</param> <param name="charting.seriesColors">[0xFF0000,0xFFE87C,0x41A317]</param> <param name="charting.legend.masterLegend"></param> <param name="charting.primaryAxisLabels.majorLabelVisibility">hide</param> <param name="charting.chart.stackMode">stacked</param> <param name="primaryAxisTitle.text"> </param> <param name="secondaryAxisTitle.text"> </param> <param name="legend.placement">top</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">435px</param> </module> </module> Any thoughts would be helpful! Thanks. ... View more

I currently have a search set up to identify an individual error clustered to show the total count, detail and last seen timestamp output into a CSV table over all time. This search is scheduled to run/update weekly. log_level="ERROR" | cluster field=error showcount=true countfield=count | table, _time, count, error | sort _time| outputcsv errorhistory.csv My goal is to use this as a refrence point whereby I can run an identical search across a period of a week / day to cross reference if the individual error has ever been seen before from the all time csv i.e. a true new error. I have attempted various lookup's however am now stuck for a way on how to work it. ... View more