I can obtain a gauge with the needle pointing to the total events with method=GET and the total being the sum of the events having method=GET and method=POST with the following: method=GET | stats count as totalGET | appendcols [search method=POST | stats count as totalPOST] | eval totalMethods = totalGET + totalPOST | gauge totalGET 0 totalMethods/2 totalMethods However the upper limit of the gauge shows 25000 and the total count is 25904 . Is there a way to make the gauge show exactly 25904 in the upper limit? ... View more

I need to group the events (in this case by JSESSIONID) and select the one with the max date I have the groups with the following query: date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID How can I get every transaction only with the newest event? TKS! ... View more