Hello! I am trying to map a search in Splunk Studio Dashboards to create a time chart showing a machines utilization per day. I want to show it by day so I can add a trend line to my single value utilization panel. To do this, I am mapping my search by day so, the utilization will be calculated per day rather than over the whole-time range. Using the code below I am able to make a time chart displaying the machines daily utilization in dashboard classic but not dashboard studios: Code: index=example |bin span=1d _time |dedup _time | eval start=relative_time(_time,"@d-1d"), end=relative_time(_time,"@d") |eval day=strftime(_time,"%D %T") |eval End=strftime(end,"%D %T") |map maxsearches=30 search="search index=example earliest=\"$$start$$\" latest=$$end$$ | transaction Machine maxpause=300s maxspan=1d keepevicted=T keeporphans=T | addinfo|bin span=1d _time | eval timepast=info_max_time-info_min_time | eventstats sum(duration) as totsum by Machine _time  |dedup Machine _time | eval Util=min(round( (totsum)/(timepast) *100,1),100) | stats values(Util) as \"Utilization\" by Machine _time date_mday" |table _time Utilization Machine |chart values(Utilization) by _time Machine |fillnull value="0" Code Results in Dashboard Classic: Code result in Dashboard Studio:   Why can't I map on Dashboard Studio?? It states it is waiting for an input. How can I break up utilization by day to show the trend line? ... View more

I am creating a two column, column chart comparing how many necklaces we made (column 1) vs. how many we need (column 2). The chart is split up by hour starting from @d-22h to now(). Yet, if no necklaces are created during a hour, the columns will not be produced and will leave a blank space. If no events in a hour: Necklaces made=constant value of necklace made during last event hour (constant) Goal= hour*60 (increase by 60 every hour) current chart: What I want: Purple rectangles=646 (constant) Orange rectangles= previous Goal value +60 (box1=540+60; box2=600+60) Code: ------------------------------------------------------------------------ |makeresults|eval early_relative = "@d-2h"|eval late = "@d+22h" |eval date_hour=strftime(now(),"%H") |eval timeofday=case((date_hour>=22 AND date_hour<=23),"@d+22h,now",(date_hour>=0 AND date_hour<22),"@d-2h,now") |eval split=split(timeofday,",") |eval early_relative=mvindex(split,0) |eval early_date=strftime(relative_time(now(),early_relative),"%m/%d/%y %H:%M:%S") |eval late = if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1))) |eval late_date = strftime(if(mvindex(split,1)="now",now(),relative_time(now(),mvindex(split,1))),"%m/%d/%y %H:%M:%S") |eval test = strftime(late,"%m/%d/%y %H:%M:%S") |map search="search index=..... earliest=\"$early_relative$\" latest=$late$ |eval hour=1|eval date_hour=strftime(now(),\"%H\") |eval timeofday=case((date_hour>=22 AND date_hour<=23),\"@d+22h,now\",(date_hour>=0 AND date_hour<22),\"@d-2h,now\") |eval late=$late_date$ |eval early=$early_date$ |bucket _time span=1h |eval Time=strftime(_time,\"%H\") |eval Goal_hour=case((Time=22),1,(Time=23),2,(Time>=0 AND Time<22),Time+3) |eval Goal=Goal_hour*60 |stats count(Neckles) as Actual_Made by _time Goal |accum Actual_Made" ----------------------------------------------------------------------- Please help!!! Thank you.   ... View more