I have created a time input and also two text boxes to pass earliest and latest values to the searches. When I select the time range from the time input, earliest and latest needs to be ignored. index=_internal sourcetype=splunkd | stats count  --> This is for last seven days. when i pass earliest and latest to the search, time input should be ignored. earliest=06/01/2021:00:00:00 latest=06/02/00:00:00 index=_internal sourcetype=splunk | stats count  I have this code: <fieldset submitButton="true"> <input type="dropdown" token="choose"> <label>choose</label> <choice value="timeRange">timeRange</choice> <choice value="specificWindow">specificWindow</choice> <change> <condition label="timeRange"> <set token="timeRange">true</set> <unset token="earliestLatest"></unset> </condition> <condition label="specificWindow"> <unset token="timeRange"></unset> <set token="earliestLatest">true</set> </condition> </change> <default>specificWindow</default> </input> <input type="time" token="timerange" depends="$timeRange$"> <label>Time</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="earliestTime" depends="$earliestLatest$"> <label>StartDate</label> <default></default> </input> <input type="text" token="latestTime" depends="$earliestLatest$"> <label>EndDate</label> <default></default> </input> How can i do this? ... View more

I have following query to display the results in pie chart. Problem here is I could not see the all the values in the pie chart   index=dummy ticket_number="*" sourcetype="tickets" | eval status= "incident_" + status | stats first(opened_at) as ticket_openedAt latest(status) as ticketStatus by ticket_number | where NOT ticketStatus IN("ticket_Resolved", "ticket_Canceled", "ticket_Closed") | eval openTime = strptime(ticket_openedAt, "%Y-%m-%d %H:%M:%S"), currentTime=now(), days = round((currentTime - openTime)/86400, 0) | where days > 5 | stats count as ticket_count by ticketStatus | appendcols [ search index=dummy problem_number="*" sourcetype="problem"     | eval status = "problem_" + status     | stats first(opened_at) as problemOpenedAt latest(status) as problemStatus by problem_number     | where NOT problemStatus IN("problem_Resolved", "request_Closed")     | eval openTime = strptime(requestOpenedAt, "%Y-%m-%d %H:%M:%S"), currentTime=now(), days = round((currentTime - openTime)/86400, 0)     | where days > 5     | stats count as request_count by problemStatus ] | appendcols [ search index=dummy issue_number="*" sourcetype="issue"     | eval status= "problem_" + status     | stats first(opened_at) as issueOpenedAt latest(status) as issueStatus by issue_number     | where NOT issueStatus IN("problem_Resolved", "problem_Closed Complete")     | eval openTime = strptime(problemOpenedAt, "%Y-%m-%d %H:%M:%S"), currentTime=now(), days = round((currentTime - openTime)/86400, 0)     | where days > 5     | stats count as problem_count by issueStatus ] | transpose I would require your help in displaying the incident_count by incidentStatus, problem_count by problemStatus and issue_count by issueStatus in the pie chart. Also, is there a way to optimize this search ... View more