I've got two servers providing me temperature data. Host A has Sensor1 and Sensor2. Host B has Sensor1 and Sensor2.  My goal is a line graph of all four sensors named as their actual room name. As long as I use host=HostA in the base search, my timechart works great with 20min avg.  index=tempmon sourcetype=tempdata host=HostA | timechart span=20min eval(round(avg(Sensor1),2)) as "Room12", eval(round(avg(Sensor2),2)) as "Room13" I'm struggling to understand if a subsearch or 'where' statement would help do something like this index=tempmon sourcetype=tempdata Where host=HostA | eval Room12=Sensor1 | eval Room13=Sensor2 Where host=HostB | eval Room14=Sensor1 | eval Room15=Sensor2 | timechart span=20min avg(Room12), avg(Room13), avg(Room14), avg(Room15)   ... View more

I've got a dashboard created with Maps+ plotting the events on the map. The next section is a table of events. I'd like to schedule this to be an automated report, send to some folks. However, the PDF reports just shows the table and "PDF Export does not support custom visualizations.   Anyone have any ideas how I could still accomplish what I'm hoping for? ... View more