Ayn's answer fails if the URL does not include a question mark. Here is a regex that works for URLs with and without a question mark: | rex field=your_url_field "^(?<your_new_url_field>[^?]+) ... View more

To have the earliest/latest values used in your SQL statement, you can do something like this: (NOTE: The UNIX time conversion below is Postgres-specific. See your DB documentation for converting UNIX timestamps to your database's date/time column type.) | dbxquery connection=myconnection query="SELECT * FROM \"user\" WHERE \"createdAt\" >= to_timestamp(?::int) AND \"createdAt\" <= to_timestamp(?::int)" [ search index=main | head 1 | addinfo | eval params=round(info_min_time,0).",".round(info_max_time,0) | fields params | format "" "" "" "" "" "" ] dbxquery takes a "params" argument whose comma-separated values are used to replace question marks in the SQL. In this case, we are using a subsearch to generate the params argument to dbxquery. To make the min/max times from the time picker available as fields, you have to use the "addinfo" command in your subsearch. ... View more

To use a DB result field as the event time, then do this: | dbxquery connection=your.db.connection query="SELECT createdAt, name FROM some_table" | eval _time=strptime(createdAt, "%Y-%m-%d %H:%M:%S") | timechart span=7d count by name This assumes date/time fields come back from your DB like 2017-10-16 16:20:00. ... View more