Hi,  I'm trying to build a line graph that would show me the completion time of an event on a daily basis. The completion time is in the timestamp field. The y axis should display the time of completion and the x axis the date Example: timestamp="2020-10-03 00:48:48.0" statusText="SUCCESS" "JOB1" timestamp="2020-10-01 21:45:22.0" statusText="SUCCESS" "JOB1" timestamp="2020-09-31 21:44:22.0" statusText="SUCCESS" "JOB1" timestamp="2020-09-30 22:48:48.0" statusText="SUCCESS" "JOB1" timestamp="2020-09-29 00:48:48.0" statusText="SUCCESS" "JOB1"  Can anyone please advise what is the best way to do this? ... View more

I have a lookup file which contains a list of jobnames, description and their SLAs. Example:  jobName Description SLA job1 Example1 08.00 job2 Example2 10.00 job5 Example3 05.00   My index data (index=autosys) contains events for hundreds of jobs, their status and updated time.  An event example would be: job1, FAILED, 07.00 I'm trying to write a query to output the below. However, there are cases where there won't be any events for a specific job. In that case, I need to display, "NOT RUNNING" jobName Description SLA Status Updatetime job1 Example1 08.00 FAILED 07.00 job2 Example2 10.00 SUCCESS 09.00 job5 Example3 05.00 NOT RUNNING NULL   I'm using the following query, but it is not displaying the row that does not have any event/data in the index       | inputlookup append=t lookup_job.csv | table jobName, SLA, Description | join jobName [search index=autosys | inputlookup lookup_job.csv | fields jobName ]] | table jobName, Description, SLA, Status, Updatedtime           ... View more