Hello,  Is there a specific way to set the color to specific colors based on the specific field? I have a stacked column chart with four possible fields used (nonconformance, part_not_installed, incomplete_task, shortage in this case) and I use a token system to only show specific fields in my chart based on those selections.  It seems that the color order is set by default. So when I remove the first option the color changes to the new top field name. Is there an easy way to lock those to the consistently be the same colors for each potential option. So locking field color with field value.    example images of the change.  vs when the fields change    ... View more

Hello Experts, I am looking at an alert that is using a join function to match a work_center with a work order. I am wondering what records in a stream of records the join is looking at to get that result? Is there a way to get the latest result.  To explain further, the work center in some cases will change based on where work is being completed, so I would like to grab the latest result when the alert runs.  The current code I am looking at using this give us a way to compare the work center in the source="punch" vs the current stream of data. I am wondering if I can further manipulate that subsearch to look at the last result in source="punch". I tried a couple things but didn't have any luck. Not super familiar with joins in my normal work.  | join cwo type left [search source=punch | rename work_center as position] ... View more

Hello, I am wondering what the best way to find a value in one my fields matches what is in a mv field. I cannot use mv expand and a where due to the storage limit I encounter. Is there a way to show that "match" matches with the values in field2, but "miss" would not.    ... View more

Hello, I am working with a large form that essentially takes inputs and creates a record of scan. The part I am focusing on is a set of two inputs that I pass as tokens into a search that at the end runs a collect function. The problem I am running into is that after I enter a value in the first input and tab into the next input. It seems the function runs. This is causing the second input to not be collected in the data unless is quickly enter and tab out of the input box. If I can do it quickly, the value is getting passed. It will not pass a value if the second input is entered but still clicked on.  Is there anyway to halt the collect function until both inputs are entered?  ... View more

Hello,  In the past, I have used the checkbox method to hide panels after opening new ones. In this example, I would like to have a panel disappear after I click on the values in the panel. Currently, my next panel appears on the click, but the existing panel still exists. I'm wondering if there is any way to hide the panel that exists after i click on what I want to pass as the token. XML preferred.    ... View more

Hello, I have been searching for a post similar to mine and just have not found it. I have to add some user inputs to a search. The process is we are assigning gps units to specific serial numbers for tracking purposes. The gps unit will be put on a product then removed when the product leaves one of our facilities. I would like to be able to barcode scan the unit then barcode scan the serial number and have it be in my searches. I threw together a lookup file to do this, but I feel like there is a better way to do this.  The only references i would really need are the gps_id and the serial_number.  I'll gladly give more description as necessary. I'm only partly familiar with more advnaced html, css, and js.  ... View more

Hello, This is a follow up post to my recent post on "Trouble with Hidden Panel Passing Value". I am having an issue with the safety ticker that I had implemented in that question. For some reason, the only result being posted is <news ticker>. The code is below. For some reason this code was working but now is not. The point of the search is to produce one result that shows the last safety incident but only in the last 48 hours. The ticker itself uses a marquee to show the results.  <form> <search> <query> index=defmfg_safety work_center="S1**" | sort 0 -_time | dedup id | head 3 | stats max(corrective_actions{}) as corrective_action by investigation_result | eval corrective_action=if(corrective_action="30 day follow up" OR corrective_action="6 month follow up","PENDING",corrective_action) | eval result=investigation_result +" -CORRECTIVE ACTION- "+ corrective_action | eval ticker=result | eval length=ceil(len(ticker)/2) . "ms" </query> <earliest>-48h@h</earliest> <finalized> <condition match="$job.resultCount$ == 0"> <unset token="ticker"></unset> <unset token="ticker_result"></unset> </condition> <condition> <set token="ticker">$result.ticker$</set> <set token="ticker_result">$result.result$</set> </condition> </finalized> </search> <row depends="$ticker$"> <panel> <html> <style> #marquee { font-size: 30px; color: white; height: 45px; white-space: nowrap; line-height: 60px; } h2 { font-size: 30px !important; text-align: center; padding: 5px !important; color: red; } </style> <h2>SAFETY ALERT</h2> <marquee scrollamount="19" id="marquee">$ticker$</marquee> </html> </panel> </row> </form> ... View more

Hello, I generally use the following format to limit specific search results from panel to panel. However, in this case I would like to search for anything containing the string.  [|loadjob $work_center_base$ | stats values(work_center) as location]  This would limit the results in my search to only what is in the work_center field. I would like to match anything that contains what is in the location field. I won't this as the locations have more description after the work_center.  ex: work_center               1CAP1 1CAP2 1CAP3 1CAP4 location  (examples to match)  1CAP1-E3 1CAP2-W4 1CAP1-W1  1CAP4-E1 ... I am wondering if I can alter my search to match these and keep all locations that contain partials of work_center.  ... View more

Hello, I am hoping this is easy and I am blanking. I have a data source the logs what work order is in station one. I am looking to get an offline_time based on when a work order reaches a certain station.  Ex  _time             WO         count 11:45             1231             1 11:40             1232              2  11:35             1233              3  11:30             1234              4 ..... etc So the _time is when the work starts and when count reaches a certain number, the work order would be done on the line(count would equal 35 in my case) . I would like to collect the _time of what is in count=1 when the count reaches 35.  Thanks.  ... View more

Hello, I am trying to find the best way to change my search based on a token value that I will pass through an input. Right now, I have a search that is filtered by a production area. I would like to be able to in that search, use the sub production area instead if one is selected. Both of these values have a token associated with them. $production_area$ and $sub_production_area$. I couldn't get a conditional in a search to work. I would only like to search based on the sub production area if a value other than the default is selected. The current search limits results by production_area=$production_area$.  I can provide more information if needed. I had trouble wording the question to fully explain what I am looking for.  ... View more

Hello, I am trying to add a break time into a cycle time that I am tracking. So the _time field pulls when the start of a cycle is. I have been using the delta function to gather the duration between the cycles. The problem that I am running into that the cycles stay on during breaks and lunch time which will add 15 or 30 minutes to the cycle time. I am hoping this is something east to account for.  The problem in my mind is that I want the solution to be scalable to multiple days. I am looking to add 15 minutes to any cycle that was started from 8:50-9:15 or 30 minutes to something 11:50-12:30. An example from the data _time duration 2020-10-26 12:40:32.593 -0.003 2020-10-26 12:40:32.577 -0.016 2020-10-26 12:35:29.080 -303.497 2020-10-26 12:35:29.058 -0.022 2020-10-26 12:35:28.967 -0.091 2020-10-26 12:30:25.567 -303.400 2020-10-26 12:30:25.547 -0.020 2020-10-26 11:50:01.608 -2423.939 ... View more