Thanks for your input, i tried to change as you said but is it possible to display the field Suspended-TC57* with red color ? please help me on that index= XXXX source="*.log" | eval description=case(Suspend Like "S","Suspended",Suspend Like "C","Completed",Suspend Like "P","Partially-Completed")|eval newField= description."-".TC57_File_Name|timechart span=1h useother=f limit=0 count by newField|sort by newField. for the below question, i am trying to display the file name with status on it when we point the mouse over the bar, also i need to display the timings on xaxis, please help me with either one of the above or below dashboard which ever works would be highly appreciated.
... View more