Is there a way, that anyone is aware of, to timechart off of a field sumarry. I can break down the fieldsummary by timecharting first, I just end up with repeated field names with what looks like hashes appended to them, which is weird. I am trying to detrmine all the NULL fields and present them in a timecharted graph by day. Currently, without the timechart portion, this is what I have. ...| fieldsummary | search values=*Unknown* | rex field=values \"Unknown\"\\S\"count\":(?<null_count>\\d+)}, |eval percent_null=(null_count/count)*100 |eval Percent1=100-percent_null |fields field Percent1 null_count
... View more