I want to generate a time chart that shows time on x-axis, results on y-axis and hue (legend) showing the different analytes. So far this what I have generated which is not the format I am looking for. I have the search code below. I probably do not need fieldformat but was thinking I needed the correct datatype. I am used to python Jupyter notebooks and am quite new to Splunk. Any help would be very appreciated. For example, I am showing a scatter plot from python that I can generate that mirrors what I am looking for in Splunk Incorrect Splunk Scatter Plot Example of What I want to get to     |inputlookup $lookupToken$ |where _time <= $tokLatestTime$ |where _time >= $tokEarliestTime$ |search $lab_token$ |search $analyte_token$ |search $location_token$ |sort _time desc |replace "ND" WITH 0 IN Results |table _time, Results, Analyte |fieldformat _time=strftime(_time, "%Y-%m-%d")         ... View more

Hello, I am rather new to Splunk and I have two values that I want to search for, but I want to combine them to one name in multiselect option (easier for user).    There are two coded values for offsite sample and onsite samples which are  offsite samples = "OffsiteComplete" and "OffsiteNeedsReview" onsite samples = "QA Approved" and "Analysis Complete" I have tried to add these both as values and use OR as delimiter but no success.  Please help!  Code is below and screenshot   <form> <label>LIMS Analytical Data</label> <description>Select Year Range First</description> <search> <query>| makeresults | add info </query> <earliest>$time_token1.earliest$</earliest> <latest>$time_token1.latest$</latest> <done> <eval token="tokEarliestTimeString">strftime($result.info_min_time$,"%Y/%m/%d %H:%M:%S %p")</eval> <eval token="tokLatestTimeString">if($result.info_max_time$="+Infinity",strftime(relative_time(now(),"0d"),"%Y/%m/%d %H:%M:%S %p"),strftime($result.info_max_time$,"%Y/%m/%d %H:%M:%S %p")</eval> <eval token="tokEarliestTime">$result.info_min_time$</eval> <eval token="tokLatestTime">if($result.info_max_time$="+Infinity",relative_time(now(),"0d"),$result.info_max_time$)</eval> </done> </search> <fieldset submitButton="true"> <input type="dropdown" token="lookupToken" searchWhenChanged="true"> <label>Year Range</label> <choice value="LIMSCSV.csv">2022-2023</choice> <choice value="LIMS2021.csv">2021</choice> <choice value="LIMS2020.csv">2020</choice> <choice value="LIMS2019.csv">2019</choice> <choice value="LIMSPre2019.csv">Pre-2019</choice> <default>LIMSCSV.csv</default> <initialValue>LIMSCSV.csv</initialValue> </input> <input type="time" token="time_token1" searchWhenChanged="true"> <label>Select Time Range within Year Range</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> <input type="multiselect" token="lab_token" searchWhenChanged="true"> <label>Result Status</label> <delimiter> OR </delimiter> <search> <query/> <earliest>-24h@h</earliest> <latest>now</latest> </search> <choice value="OffsiteComplete,OffsiteNeedsReview">Offsite Analysis</choice> <choice value="QA Approved">Onsite Analysis</choice> <valuePrefix>ResultStatus="</valuePrefix> <valueSuffix>"</valueSuffix> </input> <input type="multiselect" token="analyte_token" searchWhenChanged="true"> <label>Select Analyte</label> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>Analyte="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <fieldForLabel>Analyte</fieldForLabel> <fieldForValue>Analyte</fieldForValue> <search> <query>|inputlookup $lookupToken$ |where _time &lt;= $tokLatestTime$ |where _time &gt;= $tokEarliestTime$ |where $lab_token$ |stats count by Analyte</query> </search>   ... View more