Hi,   have you tried a delimiter?   <delimiter> OR </delimiter>  ... View more

you need to provide more information on the data...   your screenshots include the same query...how can you differntiate between event A that provides grouping data for tests and the test results themselves? ... View more

well then you need to provide us with amapping of Columns and their values and how they should be mapped....ATM this is not possible. No where in your screenshots we can see something about alpha and beta   If you are familiar with a bit of coding write some pseudo code here. ... View more

sorry but your data quality is really bad....   you have fields with NULL values and you are using those fields for "by" clauses ... View more

Anyhow, you need a series of fields as unique identifier...and event2 is not unique and the event line only states event2 and Pass...but not if it belongs to alpha or beta... You need real headers...your tables start with content, that makes it hard to answer are all summaries at least in the same index? Or are those events volatile and not persistent? ... View more

Hi you are missing some data in the columns with alpha and beta. Event Result Test Type event2 Pass alpha event3 Fail alpha event4 Fail alpha event2 Pass beta event3 Pass beta event4 Pass beta   that is what you should aim for as you column headers as far as i see from your post are misleading with that you can do: | stats count by "Test Type" Result ... View more

index="murex_logs" | bucket span=1min _time | stats count by mx.enc _time ... View more

Not quite sure what you want to save to the token... If wou want the clumn bar at the point of the x axis use Whisperes method, thatworks likje a charme in dozens of my dashs.   If you want to pass the Timestamp than this is a bit more tricky und not sure if at all possible via single click.   However, you can try:   <selection> <set token="selection.earliest">$start$</set> <set token="selection.latest">$end$</set> </selection>   This works by holding your left mouse button in the chart and selecting the timewindow by dragging. ... View more

Hi, this works like a peach if you do not have multiple lines in the trellis. If i sue this all charts are forced in one line and i get a scrollbar. Is it possible to leave the "line breaks" and still center?   Kind regards, Mike ... View more

well what you call  convolute i call very creative 😉   but does the timepicker really have such a change event? i have no refresh on the timepicker and i was intending to leave the timepicker to the same setting. i however think i can reuse my kiosk mode for that, but i think that will be rather overpowered...your solution works fine!   but for full disclosure here the kiosk mode i created for my replay dashboards:   <search rejects="$replay_stopped$"> <query> | makeresults | eval tokEarliest = CASE(now() &gt; $tok_array_timer$ + 3, $tokEarliest$ + 900, 1=1, $tokEarliest$) | eval tokLatest = CASE(now() &gt; $tok_array_timer$ + 3, $tokLatest$ + 900, 1=1, $tokLatest$) | eval zeit = CASE(tokEarliest = $tokEarliest$, $tok_array_timer$, 1=1, now()) | eval human_start = strftime(tokEarliest, "%H:%M %d.%m.%Y") | eval human_end = strftime(tokLatest, "%H:%M %d.%m.%Y") </query> <refresh>5sec</refresh> <done> <set token="tokEarliest">$result.tokEarliest$</set> <set token="tokLatest">$result.tokLatest$</set> <set token="tok_human_start">$result.human_start$</set> <set token="tok_human_end">$result.human_end$</set> </done> </search> i could use the same to re-initialize the append token ... but that would be a far more complicated solution 😄 ... View more

so there is no kind of escape character in tokens to carry tokens...too bad...But thanks mate, your way works like charme ... View more

Hi, there is an issue with how tokens in checkboxes work...it works if checked but it does not if unchecked as the chart is waiting for the input...which is the token of the checkbox (that is not set if unchecked). it works with helper tokens: <input type="checkbox" token="tok_input_0"> <label></label> <choice value="yes">Something rather boring)</choice> <change> <condition value="yes"> <set token="my_token">"YES"</set> </condition> <condition> <set token="my_token">"NO"</set> </condition> </change> </input>   | appendcols [ search index=<my_index> earliest=$tok_earliest_ref$ latest=$tok_latest_ref$ | where "$my_token$"=="YES" | timechart span=5min partial=f sum(Average) as "reference"]     ... View more

so you are proposing to include the query no matter what but have some kind of "depends" in it? ... View more

Hi Iso, i just assumed that he wants to do: Total Hours in case Type is A Actual Hours in Case Type is B   basically he tried using by as a filter...i think ... View more

Hi,   the easiest way would be an append...i am sure that there are multiple solutions out there to get this in one Go....but why bother if it can be achieved by a simple "append"   Regards ... View more

  For example if i would do it in any typical language i would split the param string into a list (or array), and then inserted indexed values into proper positions in message string. So you have a basic set of messages with placeholders...okay where is the problem? You define a lookup with those message and assign an ID...depending on the ID a specific message template is loaded. Now the only thing missing are the values...well those are being retrieved with the same ID and then inserted into the template as demonstrated. Depending on the amount this can be done with CASE or a separate lookup table | makeresults | eval ID = 2 | eval var1 = Case(ID=="1", "11", 1==1, "21") | eval var2 = Case(ID=="1", "12", 1==1, "22") | eval var3 = Case(ID=="1", "13", 1==1, "23") | eval message = Case(ID=="1", "Product [" . $var1$ . "] is on hold in process [" . $var2$ . "] hold description: [" . $var3$ . "]", 1==1, "Material [" . $var1$ . "] already assigned to [" . $var2$ . "]") | table message Please change ID value and append Case options OR create Lookups ... View more

Hi,   i am not entirely sure i understood your issue... is that what you need? | makeresults | eval var1 = "11" | eval var2 = "12" | eval var3 = "13" | eval message="blablabla [" . $var1$ . "] blablabla [" . $var2$ . "] blablabla [" . $var3$ . "]" | table message   ... View more

Hi,   i assume that you did not get any results because you used search instead of where.   Try your code with "where"...might already do the trick.   Regards, Mike ... View more

Awesome thanks!! was actually child(2) but anyhow works like a charme!!   Thanks, Mike ... View more