works great, many thanks!   ... and for multi-select i.e. links input type , this is for tooltip of each of the choices:     $('#i_stats > div > div > div').find('button[label="kosten"]').attr('title','Kosten in Euro').attr('data-toggle','tooltip').attr('data-placement','bottom'); ... View more

absolutely great, because it is also expandable to more than two datasets to be compared. here's what i done for a "triff": index=a | stats count by PSP_Element | rename * as a_* | rename a_PSP_Element as PSP_Element | eval a=1 | append [ | inputlookup koop_aws_spitz_zahlen PSP_Element=* | rename * as b_* | rename b_PSP_Element as PSP_Element | eval b=1 ] | selfjoin max=0 keepsingle=yes PSP_Element | append [ | makeresults format=csv data="PSP_Element F-330751 F-330755 F-330758 " | rename * as c_* | rename c_PSP_Element as PSP_Element | eval c=1 ] | selfjoin max=0 keepsingle=yes PSP_Element | where isnull(a) OR isnull(b) OR isnull(c) | eval x = coalesce(b_PLAN,a_Preis) | sort - x | fields - x | fields PSP_Element c a b * ... View more

thanks, saved me loads of redundant coding! i.e. elegant new solution setting dashboard tokens: | sort 0 area -error_rate | dedup area | eval x=area+"_service_id" | eval {x} = service_id | fields - x service_id | eval x=area+"_service" | eval {x} = service | fields - x service | eval x=area+"_value" | eval {x} = error_rate | fields - x error_rate | eval x=area+"_color" | eval {x} = color | fields - x color | fields - area _time | stats values(*) as * ... View more

my recent experience in having  chained searches depending on token: <search id="s1" base="mybasesearch" depends="$run$"> <query>| eval run="$run$" ...</query> </search> <search base="s1">...</search> ... View more

give that field to search for a default value which is not appearing in the list (you will need to use the dashboard sourcecode editor).  <input type="checkbox" token="field10"> <label>Aufteilung</label> <choice value="inst">System.Touchpoint</choice> <choice value="datasource">Lauf</choice> <choice value="robotId">Client</choice> <delimiter>.".".</delimiter> <default>x</default> </input> in the search query use an if to set your own default: ... | eval x=inst | eval gruppe=$field10$ | timechart $field3$(awz) by gruppe</query>   ... View more

this works for me: | makeresults count=4 | addinfo | streamstats count as i | eval threshold=if(i<=2,100,500) | eval _time=if(i%2==1,info_min_time,info_max_time) | eval mm=if(i<=2,"low","high")| table _time,threshold,mm| timechart cont=false avg(threshold) by mm ... View more

having token in endpoint, and doing that setting in responsehandler.py leads to doubling param in subsequent call: url addr: https://my.rest.partner/getsomedata?start=$since10min$ url args: <none> responsehandler: myresphdl tokens.py: def since10min() responsehandler.py: def myresphdl() params[since10min] = "xx" --> next call calls https://my.rest.partner/getsomedata?start=10&start=20 leading to error from rest-peer   also, if rest-peer throws error,the responsehandler never gets the chance to set the params in reststate.   i solved this by having no tokens used, rest-peer throws error but i ignore it (tweak rest.py), set the responsehandler params and voila, next time it works   is there a better way to achvieve same? ... View more