You can have local time picker for that panel only Make sure time's token should be unique <panel> <title>This is Titel here</title> <input type="time" token="time_tok"> <label>Time</label> <default> <earliest>-3h@h</earliest> <latest>now</latest> </default> </input> <chart> <search> <query>******QUERY********</query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> <sampleRatio>1</sampleRatio> <refresh>10m</refresh> <refreshType>delay</refreshType> </search> ... View more

just form the concatenation of the result data and keep as _raw data custom in summary index this is workaround basically which is also good solution ....... | eval newraw=newtime . " report=\"" . report. "\",logtime=\"" . logtime . "\",origsource=\"" ... | eval _raw=newraw | collect index=my_summary ... View more

just form the concatenation of the result data and keep as _raw data custom summary index this is workaround basically which is also good solution ....... | eval newraw=newtime . " report=\"" . report. "\",logtime=\"" . logtime . "\",origsource=\"" ... | eval _raw=newraw | collect index=my_summary ... View more

Sample Example index=”xxxx” sourcetype=”xxx” earliest=-0d@d latest=now | eval ReportKey=”today” | append [search index=”xxxx” sourcetype=”xxx” earliest=-1d@d latest=-0d@d | eval ReportKey=”Yesterday" | eval _time=_time+60*60*24] | timechart span=1h avg(abcsdf) by ReportKey ... View more

Try Time Range from "Setting >> User interface >> Time ranges >> Add new " ... View more

Yes you can do from backend in Splunk search head server Need to move Dashboard xml file in splunk/etc/apps///data/ui/views And update default.meta file under /metadata/default.meta file as [views/XXXXXX_dashboard] access = read : [ user], write : [ poweruser ] export = none owner = XXXXX version = 6.5.1 modtime = 45356436543674 ... View more

Just need to select HOST as Apply To and * in named field as below while Lookups » Automatic lookups » Add new No need to edit Props.conf gile Thanks Neeraj Singh Dhapola ... View more

I am with @SoWings as newer Version has below option <option name="charting.chart.nullValueMode">connect</option> ... View more

Below worked for me instead of PARAM <option name="charting.chart.nullValueMode">connect</option> <option name="charting.chart.showMarkers">true</option> ... View more

yes i tried same after getting your post but i am getting below response i think admin only can do response> messages> msg type="ERROR">Forbidden /messages> /response> ... View more

I am normal power user don't have admin rights or cant restart the search head. Please let me know how can I do debug and refresh. Appreciates for the response. ... View more

yes same sourcetype or index As I can see the results that means query is working. Issue is only with VIEW (Permission) for other users which I have given already in field extration ... View more

@Masa Thanks for the response DELIMS = "~" should work for events like "Value01~Value02~Value03" Event data example : 2017/03/13 17:04:03.901000~13-MAR-17 05.04.03.885000 PM~13-MAR-17 05.04.03.886000 PM~xxx Client~xxxx~~com.ConnectionError: Error while connecting to remote host.~~~xxxxxxxx~xxxxxxxxxx~xxxxxx/~PASS~xxxxxx~BIS~~xxxx-xxxx-xxx-xx-xxxx~xxxx-0849-11e7-xxx-xxxxx~0~0 When you do mouse over to extract the field for the search splunk is not able to separate with ~ sign OR once you did field extract after the if you do query on field (i.e field1=xxxx) not able to get result. I hope this will make more clear. (as of now I have changed ~ to | ) DELIMS = "!#!" will translated as "! OR # OR !" because DELIMS takes one character as a separator. Yes, this one resolved the issue as I can use only one character as separator. Issue is when I am selection OTHER and its showing text box where I can give more then 1 character which is giving sense that I can use more then 1 characters as separator. Need to update TEXT box length as 1 ... View more