Hello i search the solution but it doesnt work any help I have "error in 'where' comance the expression is malformed. Expcected )" <form>
<label>bb3</label>
<description>test</description>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| inputlookup file1.csv
| rename count as "file1"
| append
[| inputlookup file2.csv |
rename count as "file2" ]
| append
[| inputlookup file3.csv
| rename count as "file3" ]
| append
[| inputlookup file4.csv
| rename count as "afile4" ]
| append
[| inputlookup file5.csv | dedup _time
| rename count as "file5" ]
| append
[| inputlookup file6.csv
| rename count as "file6" ]
| where _time >= relative_time(now(), $field1.earliest$) AND _time < relative_time(now(), $field1.latest$)
| stats values(*) as * by _time
| addtotals col=t row=f label=Total labelfield=_timee</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
... View more
