My data currently looks like this: Date Name 2022-11-01 ABC 2022-11-01 DEF 2022-11-01 GHI 2022-11-02 JKL 2022-11-02 MNO 2022-11-03 PQR 2022-11-03 STU 2022-11-03 VWX 2022-11-03 YZ1   I would like it to look like this: Date Name 2022-11-01 ABC 2022-11-01 DEF 2022-11-01 GHI     2022-11-02 JKL 2022-11-02 MNO     2022-11-03 PQR 2022-11-03 STU 2022-11-03 VWX 2022-11-03 YZ1   I need an empty row to be inserted whenever the Date differs from the value before it. ... View more

Hi, I would like to set time ranges from 2 different types of inputs, Dropdown and Time, as shared tokens into a panel. Currently, this is the code I have, the Dropdown has 4 options, and the Time input appears depending on the last dropdown option. I am stuck on passing the time range from the Time input into the "custom_earliest" and "custom_latest" tokens.     <fieldset submitButton="false"> <input type="dropdown" token="field1"> <label>Time Selection</label> <choice value="yesterday">Yesterday</choice> <choice value="-7d">Last 7 Days</choice> <choice value="mtd">Month To Date</choice> <choice value="custom">Custom Time</choice> <change> <condition label="Yesterday"> <set token="custom_earliest">-7d@d+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Last 7 Days"> <set token="custom_earliest">-4w@d+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Month To Date"> <set token="custom_earliest">-5mon@mon+7h</set> <set token="custom_latest">@d+7h</set> <unset token="showCustom"></unset> </condition> <condition label="Custom Time"> <set token="showCustom">Y</set> </condition> </change> <default>yesterday</default> <initialValue>yesterday</initialValue> </input> <input type="time" token="customTime" depends="$showCustom$"> <label>Time Range</label> <default> <earliest>-3d@d+7h</earliest> <latest>-2d@d+7h</latest> </default> </input> </fieldset>     Any help would be appreciated, thanks! ... View more

Hi, I would like display values of variables from an event as a Table.  My data format is as follow: Time Event 9/16/22 10:10:10.000 AM index=* sourcetype=* type=* "Name1" : "A", "Name2" : "B", "Name3" : "C", ... "Name10" : "J", "Var1" : 10, "Var2" : 10, "Var3" : 25, ... "Var10" : 50 I would like the search data to be transformed into a table formatted like this, internalizing the field names Name*, Var* and replacing the column headers with new names as shown below. Station Value A 10 B 10 C 25 ... ... J 50 How can I do this? Thanks ... View more

Hi, I have a search that uses the chart command to split by 2 fields, such that the results are shown below. The data is split by Name and Month. I would like to add a row with the average of all Names for each month, and a column with the average of all Months for each Name. I have tried using appendpipe and appendcols for each case, but couldn't quite figure out the syntax using a chart command. PS. Each row is already an appended subsearch. ... View more

Hi, I would like to know how to run searches using different time ranges in dropdown. For example, an input in the dropdown would be labelled "Yesterday", and I would like to assign 2 different time ranges to the same label, such that I can run 2 different searches using the separate time ranges by just selecting one input from the dropdown. I have tried defining 4 tokens under the same label, but it doesn't work, ie.   <choice value="yesterday">Yesterday</choice> <condition label="Yesterday"> <set token="custom_earliest">-8d@d+7h</set> <set token="custom_latest">@d+7h</set> <set token="breakdown_earliest">-1d@d+7h</set> <set token="breakdown_latest">@d+7h</set> </condition>    Thanks ... View more

Hi, I have multiple timecharts which have similar search queries, sharing the same index, the only difference is that they are from different metric names, ie     | mstats max(my_Var) AS my_Var where index=* AND "internal_name"="A1" ... | timechart span=1w sum(Var) AS output | mstats max(my_Var) AS my_Var where index=* AND "internal_name"="A2" ... | timechart span=1w sum(Var) AS output     .. and so on. I would like to have a panel where the various "output" are summed into a combined timechart. I have seen some similar solutions involving tokens, but I am unfamiliar with how they work, so I hope that someone can walk me through what to do, or any other solutions will be great too. Thanks   ... View more

I need to exclude events from a timechart only if they fulfill 2 conditions: the field returns 0 for ALL events in the entire day (24hours) AND the days are weekends (Saturday & Sunday) I have tried  | date_wkend = strftime(_time,"%A") | search NOT (date_wkend = "Saturday" AND varA = 0) | search NOT (date_wkend = "Sunday" AND varA = 0) However this also excludes the events from a weekend that has some non-zero results for varA, and since I have to do some further calculations based on a full-day span, my calculations are inaccurate. ... View more