Hi @bowesmana & @ITWhisperer ,
Thanks for your reply! I have tried using selection but facing some error even after this warning this is not working. "Invalid child="selection" is not allowed in node="viz" "
<row>
<panel>
<title>status</title>
<viz type="timeline_app.timeline">
<search>
<query>index=$siteid$ sourcetype=logs* CAT IN ("TAT") _raw=*** (NOT CODE=* OR CODE IN ("T11"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
| fillnull value="N/A"
.............................
| eval displayname="Operational".displayname
| table _time displayname FIELD_01 duration
| append
[ search index=$siteid$ sourcetype=FSC* CAT IN ("ST") _raw=*** (NOT CODE=* OR CODE IN ("Ad13"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
..............................
| table _time displayname FIELD_01 duration
]
</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="height">460</option>
<option name="refresh.display">progressbar</option>
<option name="timeline_app.timeline.axisTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.colorMode">categorical</option>
<option name="timeline_app.timeline.maxColor">#DA5C5C</option>
<option name="timeline_app.timeline.minColor">#FFE8E8</option>
<option name="timeline_app.timeline.numOfBins">6</option>
<option name="timeline_app.timeline.tooltipTimeFormat">SECONDS</option>
<option name="timeline_app.timeline.useColors">1</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<selection>
<set token="selection.earliest">$start$</set>
<set token="selection.latest">$end$</set>
<set token="start.count">$start.count$</set>
<set token="end.count">$end.count$</set>
</selection>
<drilldown><link target="_blank">search?q=
<query>index=$siteid$ sourcetype=FSC* CAT IN ("TAT") _raw=*** (NOT CODE=* OR MARKCODE IN ("TZ11"))
| head 100000
| where _time >= $selection.earliest$ AND _time ?<= $selection.latest$
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
..................
| table _time displayname FIELD_01 duration
| append
[ search index=$siteid$ sourcetype=FSC* CAT IN ("ST") _raw=*** (NOT CODE=* OR CODE IN ("Ak03"))
| head 100000
| eval Eventts_date=substr(Eventts,1,10)
| eval Eventts_time=substr(Eventts,12,8)
| eval Eventts_new=Eventts_date." ".Eventts_time
| eval _timee=strptime(Eventts_new,"%Y-%m-%d %H:%M:%S.%6N")
............................................
| eval displayname="Maintenance".displayname
| table _time displayname FIELD_01 duration
]
</query></link></drilldown>
</viz>
</panel>
</row>
... View more