I have a single-value panel. Is it possible to display another panel only after clicking on the single-value one? ... View more

I used $result.fieldname$ but that only returns only one (the first) result of the search. Is there a way i can get all of the search results and loop over them if possible? ... View more

  index=index1 type=1 feature IN ([search index=index1 type=type2 application=weather_app | dedup feature | fields feature | format ])     The above code returns this error and i cant seem to figure out how to fix it. Any help would be appreciated Error in 'search' command: Unable to parse the search: Right hand side of IN must be a collection of literals. '((feature = "feature1") OR (feature = "feature2") OR (feature = "feature3") OR (feature = "feature4") is not a literal. ... View more

The search below doesn't work when i add department in the group by fields in the streamstats commands. It works with any other field but this one. Can someone please give some insight?       index=... | lookup lookup cn as user OUTPUT department | reverse | dedup department application feature time | streamstats current=f window=1 values(currTotalCount) as prev_count by application feature department | table department application user display time feature currTotalCount prev_count       The prev_count field is empty when i add the department in the group by fields (streamstats command), otherwise it shows the correct result. ... View more

I have a certain amount of events (generated every 5 min) for a set of websites and their user base and their country.  The goal is to find the number of distinct users per hour/day/month for each website per country during the last 6 months. So at the end it will look something like this: Over the last 6 months: Country1 - Website1 -  12 users/hour (or day, month) Country1 - Website2  -  2 users/hour (or day, month) Country3 - Website1 -  10 users/hour (or day, month) Country2 - Website3  -  8 users/hour (or day, month) And what would be the most appropriate chart to visualize the outcome?   I have come up with this line but i'm not sure if it gives out what i want (the hourly average)   index... | chart count(user) as no_users by location website span=1h ... View more

  I have the table below and want to reflect the severity of the duration metric by highlighting the entire row index=... | eval epochtime = strptime(startTime,"%a %m/%d %H:%M %Y") | eval start = strftime(epochtime,"%a %d/%m/%Y %H:%M") | eval duration = tostring(round(now()-epochtime), "duration") | table time user client start duration    Is it possible to highlight or outline the entire row in red if the duration > 08:00 ... View more

So from my research it looks like Base Searches increase the performance of the dashboards. A dashboard with several views loads faster if the query of each view is using a pre-existing base search. However my friend is convinced that that's not the case and using Base Searches does the opposite - it prolongs the loading time of the dashboard. Has anyone else had such experience? ... View more

I'm trying to identify all the dashboards broken from lookup files being deleted. But since there's way too many dashboards, is there any not-so-manual way to find out all the inconsistencies regarding lookup files without running the dashboards one by one? ... View more