I want to get QID list from yesterday’s published data.  For that I'm using PUBLISHED_DATETIME field with yesterday’s date. The date format for that field result is in GMT format (2005-11-11T08:00:00Z). For example, I’m running this search on may 4th, but I need to get QID fields with published date as 05/03/2022. (May 3rd) |table QID PUBLISHED_DATETIME ... View more

I have two dropdowns.  I only want to run a single dropdown everytime for a search. Closed Dropdown has token value as field1 OPEN Dropdown has token value as field4 In the dashboard's source, I have listed below query, so that the panel picks up the data as per input provided in dropdowm index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" OR BAR="$field4$"|chart count(IP) by BAR,STATUS So If select closed dropdown the chart should provide the details only related to Closed and vice-versa. Please help. ... View more

I'm looking to convert the results for these fields  in PST time zone, so that I can fetch the events based on these fields but not based on the event timestamp. Below two fields are in GMT format. Please help FIRST_FOUND_DATETIME="2021-12-12T08:30:29Z", LAST_FOUND_DATETIME="2021-12-20T16:12:28Z     ... View more