Hi i've got a similar scenario where i am trying to store current timestamp (EPOCH) into a KVStore. however i cant seem to get it working.Some help will be appreciated // Create Search manger to get current timestamp EPOCH TIME var timestamp_search = new SearchManager({ "id": "timestamp_search", "status_buckets": 0, "latest_time": "$latest$", "search": "| stats count as timestamp | eval timestamp = now()", "earliest_time": "$earliest$", "cancelOnUnload": true, "app": utils.getCurrentApp(), "auto_cancel": 90, "preview": true, "runWhenTimeIsUndefined": false }, {tokens: true}); // retrieve data from search manager var timestamp_search_obj = timestamp_search.data("preview"); timestamp_search_obj.on("data", function() { var timestamp_search_result = timestamp_search_obj.data().rows; }); // Create a dictionary to store the field names and values var record = { "time-stamp": timestamp_search_result }; ... View more

For getting all the values matched in a multivalued field, use max_match=0 (for unlimited) ... View more

You should take a look at getting the macro to work - it'll be miles faster than launching an entire subsearch just to do a tiny calculation. You know the search for AppName="Master" isn't affected by the outer earliest and latest , right? ... View more

I believe the first part isn't necessary. Try running this: [search ContextId = "fcdc6c40-4ebe-4d0f-9481-ebb1701a6aae" Pipeline = "RR" | fields Data.Request.Payments{}.PaymentId] | table Data.Response.TotalPayablesCount ... View more

Subsearches can be useful, but be careful with them. They essentially add 'foo' OR 'bar' OR 'baz' OR ... to your search, which gets really messy when the sub search returns a lot of values. I also highly recommend ending the sub search with the | format command, as that will format the output in proper search terms. (ContextId=12345) OR (ContextId=23456) OR ... ... View more

This is exactly what I was looking for. Thank you ... View more

Actually the query gives you graph for top 5 Files modified every month and it's possible that the top 5 files differs between months (e.g. A,B,C,D,E in month1 and A,B,G,E,F in next), hence its giving more than 5 fields. Also, The timechart bydefault show top 10 values and put remaining smaller values in one group called OTHER. You can disable showing other by using "useother=f" at the end of timechart command. ... View more

That worked! Thank you! ... View more