Hi, I have a dashboard with time picker and a dummy search to transform relative timestamps to absolute timestamps:   <search> <query>| makeresults</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> <progress> <eval token="timeEarliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> <eval token="timeLatest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> </progress> </search>   Next, I have a chart querying something using the timepicker from the form. Per default, the chart will automatically adjust the X-Axis to the results found, not the entire searched timespan. I want to change this behavior and tried setting chart.axisX to the absolute timestamp values, but it doesn't seem to work. Is there something that I am missing?   <chart depends="$timeEarliest$,$timeLatest$"> <search> <query>... | chart count OVER _time BY some_field</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> <option name="charting.axisX.minimumNumber">$timeEarliest$</option> <option name="charting.axisX.maximumNumber">$timeLatest$</option> <option name="charting.chart">column</option> </chart>           ... View more

Hello, I would like to make a stacked column chart with number of errors by hour and error type (warning, error, etc) The log lines look like this:   [2023-07-19T03:55:16,043][ERROR][o.o.s.i.DetectorIndexManagementService] [opensearch-cluster-master-2] info deleteOldIndices     I was filtering out INFO messages, parsing the error type using a regex (which both work so far), but I cannot group it by error type.     index=* "pod"="*opensearch*" | search NOT "[INFO ]" | rex field=_raw "^\[([0-9\-T:,]*)\]\[(?<type>[A-Za-z ]*)\]" | timechart span=1h count ```| stats avg(count) as count by Hour type``` | chart avg(count) AS count BY Hour type     I only get one value per hour, labeled as "count". Any suggestion how I could split it by Hour *and* type? Thank you! ... View more