Give this a try index=xxx host=xxx (sourcetype=ABC* OR sourcetype=DEF*) Agent_NumberOfAgents=* earliest=-14d@d latest=now | eval Platform=if(like(sourcetype,"ABC%"),"ABC","DEF") | eval week=if(_time>=relative_time(now(),"-7d@d"),"ThisWKTotal","LastWKTotal") | dedup week Platform host | chart sum(Agent_NumberOfAgents) over Platform by week | eval Difference=ThisWKTotal-LastWKTotal ... View more

I can confirm that this is still an issue in 4.3, but note that it's only an issue if your saved search is loading from a previously scheduled search. If your savedsearch has no jobs saved from previously scheduled runs, or if you set the useHistory param to "False", the bug will go away. Likewise if the search is not a saved search at all but just a regular inline search. In those cases the timechart command applied by HiddenPostProcess does not have this "clamping in" effect. as for fixedrange=false, it's definitely a related param, but it isn't the solution in this case. Actually note that in a normal search setting fixedrange to false in timechart will actually create this behavior, not turn it off. And I checked just to be sure and adding that to the postprocess'ed timechart doesn't seem to fix the behavior. I also tried some weird tricks like adding addinfo to the base search, to see if I could get the base job to have whatever secret info that the ad-hoc searches have, that makes the postProcess not do this. However I had no luck. Maybe someone else can comment. ... View more

Thanks a lot for sharing this approach! It helped me out and I can confirm that it worked for me as solution for the above problem. ... View more

This worked thanks! ... View more

I have tried used this command however it will only return unique results from the search window selected such as that week. Which i can get by adding | search(count=1) | Rather I need the unique results (i.e. count equal to 1) for the week and have not appeared in the errorhistory.csv Any thoughts? ... View more