Hi Haph, I'm facing the same issue. can you tell me if we can not include search in searchManager then where else we can include it. ... View more

yes, moving the indexes.conf file to system/local solved the issue. ... View more

@niketn Thanks Below is the original query that I am using... index="idx" |eval d=replace(strptime(update,"%Y-%m-%d"),".\d+","")|eval date=strftime(d,"%B %Y")|where like(date,"February 2017%")|chart count as Count by d |makecontinuous d span=1d |fillnull|eval date=strftime(d,"%Y-%m-%d") | chart values(Count) as Count by date here I am using "update" field as time field. And month I will get dynamically by passing token from the dropdowns. My idea is to get the count of events on every day of the month . Even if the day has no event it should give it 0. I'm using makecontinuous to do that but the issue with this is that it makes the dates continuous only from the first non zero event it finds. Like if the first non zero event it find is on 3rd of month then it will make the days continuous from that day leaving 1st and 2nd day. So I wanted to use start and end attributes of makecontinuous to make it forcibly start from first day of month. But they only take epoch values. So I tried to pass these values via fields with the below query in between. But it doesn't work. Tell me if there is any other way I can make my data continuous. eval earliest=relative_time(strptime("01-February 2017","%d-%B %Y"),"+0mon"), latest=relative_time(earliest,"+1mon")|eventstats first(earliest) as earliest first(latest) as latest |makecontinuous d span=1d start=earliest end=latest ... View more