thanks @nilaksh, It gives a hint ... View more

hi @alacercogitatus, did you find any solution or alternate to his problem, bcs I am facing the same problem. ... View more

I increased MAX_DAYS_HENCE to 20 days in props.config. But the result is still same, it is not reflecting, I closed Splunk and open it again. My data is one week ahead of current date. ... View more

I think we need little bit of JavaScript to make it work. Even after that if I unset token also, the bar chart will show 'waiting for input'. As my chart query is: /source/ |where state="$State$"|chart count by Product ... View more

HI Nikks, <set token="State">$click.value$</set> this is what I added under drill down , to get values of clicked state. I don't think unsetting token there, would make any sense. ... View more

thanks for your reply. I tried this but 'Total' is coming as a payment method and adding up in the chart ... View more

Working..thanks @adonio. Can we remover that 'var 1' label from Y-axis ... View more

correction: I want to skip group by track ... View more

yes I tried, almost got it. one issue remaining is I have to show separate timeline for each event, not overlapped. Query: /source/ | rename "Date Event Began" AS start_date | rename "Date of Restoration" AS end_date | rename "Time Event Began" AS start_time | rename "Time of Restoration" AS end_time | eval _time = strptime(start_date." ".start_time, "%m/%d/%Y %H:%M") | eval end_time = strptime(end_date." ".end_time, "%m/%d/%Y %H:%M") | eval duration = (end_time - _time) * 1000 |stats count by _time, Track, duration, "job" | table _time "Track" "job" duration I want to skip Track and display separate timeline for each job in that track hence avoiding overlap ... View more

here ... View more

I have to display time- range, (start-time and end-time) Vs Track. So when using either aggregate function it will return single value, but it should be time range. I am trying using Timeline Visualization. ... View more