Hi, I wonder if anyone can help with this please. I have a search (that runs as part of the PCI compliance app) that when ran as two separate searches work fine, but joined together, the fields time & uptime are in the resultant table but empty. (within the inner search those fields are there and populated just fine). This is the overall search (That nulls fields uptime and time) - Although asset_id is reported just fine. | assets | join type=outer asset_id [| tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search ( get_category(pci) ) () | fields time uptime asset_id] If I simply run the inner search (This works perfectly - reporting time, uptime and asset_id) | tstats summariesonly count,latest(All_Performance.OS.Uptime.uptime) as uptime,max(_time) as time from datamodel=Performance.All_Performance where nodename=All_Performance.OS.Uptime by All_Performance.dest | drop_dm_object_name(All_Performance) | get_asset(dest) | rename dest_asset_id as asset_id | unprepend_assets(dest) | search ( get_category(pci) ) () | fields time uptime asset_id Any thoughts - appreciated. Thanks Derek ... View more

Hi All, I have a search that results in 2 fields, that I would like to use as a single value field in my dashboard, and access the second field as a token to be used in either the panel title, or the single value caption. As an example - My search ends like | stats count values(fileName) AS fileName which results in; count | fileName 31 | derek.txt Is there a way to access the filename field as a token? I thought I may just be able to use $result.fileName$, but it appears not. I've also tried $result.fileName$ and then using that as my token in the title, but no joy. To give you an idea, currently my XML looks like <title>$result.fileName$</title> <single> <title></title> <search> <query>search .... | stats sum(processCount) AS Processed values(fileName) AS fileName</query> </search> <option name="colorBy">value</option> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trendColorInterpretation">standard</option> <option name="trendDisplayMode">absolute</option> <option name="unitPosition">after</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> <option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="linkView">search</option> <option name="underLabel">$fileName$</option> </single> </panel> Any thoughts, appreciated. Derek ... View more

Hi, I would like to be able to push a new value into a multi-valued field, from another field. ie. Field1="Derek" mvfield2="Paul" "Dave" "Bill" I'd like to be able to do something like mvfield2=mvfield2 + Field1 It looks like I maybe able to get around it by converting the multivalued field to a delimited string, adding the value of field1, then make a new multivalued field, but that seems a long way around what seems like something simple. Does anyone have any better ideas ? Thanks for the help Derek ... View more