I want to strip certain results by time from my search. I eventually plen to place a dedup command between the first and second searches, however I am running into issues with the earliest and latest modifiers on search in the second search. The following 3 searches work fine and return results throughout the week:     host=x host=x earliest=-7d host=x earliest=-7d | search *     But these searches return no results: even when there are events in the listed time frame.     host=x | search host=x earliest=-7d host=x | search host=x earliest=-4d     Does anyone have any idea why? I would like to strip off search results based on time in the second search but it doesn't seem to work. ... View more

I have multiple events such as below: Key points here: New values of event_type may be added randomly and the schedule may be randomly changed for different event types. I just want an alert for if an event gets missed or delayed more than x (seconds/minutes/hours) longer than between the previous events Then I want it to see the new normal for that event type. Specifically: if the difference in time between now and the last event is more than x (seconds/minutes/hours) greater than the difference between the last event and the previous one, I want to trigger an alert. 8:03am event_type=1 8:05am event_type=2 8:15am event_type=2 8:25am event_type=2 8:33am event_type=1 9:15am event_type=2 10:05am event_type=2 Example: The search should see that event type=1 happened at 8:03 and at 8:33 (difference 30 min) so the next event_type=1 should be at 9:03. If x is 5 min., then at 9:08, an alert should be triggered if event_type=1 is not seen. Similarly, event type=2 happened at 8:15 and 8:25 (difference 10 min) so if x is 5 min then at 8:40 an alert should be triggered for a missing event_type=2. In this example someone changed the schedule for event_type=2 (to 50 minutes), so after seeing an event at 9:15, it should expect the next one at 10:05 since the difference between the last two was 50 minutes. What I tried: event_type="*" | streamstats current=f window=2 earliest(_time) as time_2 latest(_time) as time_1 by event_type| eval time_0_diff = time_1 - _time | eval time_1_diff=time_2 - time_1 | eval time_variance=time_0_diff - time_1_diff | This only works if I have an event though and I am specifically looking for when an event is missing (or delayed). ... View more

I would like to change the x-axis to a logarithmic timescale of the timeline like on the y-axis. So, for instance, the first inch would be the first 10 seconds, the second inch would be the first 100 seconds etc. This way I could see what is happening right now as well as over the past day/week/month all on one timeline. So if traffic appears as a diagonal line from upper left to lower right then I know that what I am seeing this minute is typical of the past hour, day, week, month etc. If this doesn't exist, where should I go to create such a timeline? ... View more