Hi, i'm very close to solution, i've managed to see a timechart that shows the transfer_in_MB where the combined JNLs are above 900, and all i need to do is display it in a hourly interval and display each column count. (timechart span=1h count(transfer_in_MB) by JNL*), but it doesnt work with "*" index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA (JOURNAL_ID="014" OR JOURNAL_ID="00A" OR JOURNAL_ID="000" OR JOURNAL_ID="01E") | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | table _time IDs transfer_in_MB | dedup _time IDs | timechart span=1m avg(transfer_in_MB) by IDs | eval JNL000_00A=if(JNL000+JNL00A<900,0,JNL000+JNL00A),JNL000_014=if(JNL000+JNL014<900,0,JNL000+JNL014), JNL000_01E=if(JNL000+JNL01E<900,0,JNL000+JNL01E), JNL00A_014=if(JNL00A+JNL014<900,0,JNL00A+JNL014), JNL00A_01E=if(JNL00A+JNL01E<900,0,JNL00A+JNL01E), JNL014_01E=if(JNL014+JNL01E<900,0,JNL014+JNL01E) | where JNL000_00A > 900 OR JNL000_014 > 900 OR JNL000_01E > 900 OR JNL00A_014 > 900 OR JNL00A_01E > 900 OR JNL014_01E > 900 | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E ... View more

Hi, i'm very close to solution, i've managed to see a timechart that shows the transfer_in_MB where the combined JNLs are above 900, and all i need to do is display it in a hourly interval and display each column count. (timechart span=1h count(transfer_in_MB) by JNL*), but it doesnt work with "*" index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA (JOURNAL_ID="014" OR JOURNAL_ID="00A" OR JOURNAL_ID="000" OR JOURNAL_ID="01E") | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | table _time IDs transfer_in_MB | dedup _time IDs | timechart span=1m avg(transfer_in_MB) by IDs | eval JNL000_00A=if(JNL000+JNL00A<900,0,JNL000+JNL00A),JNL000_014=if(JNL000+JNL014<900,0,JNL000+JNL014), JNL000_01E=if(JNL000+JNL01E<900,0,JNL000+JNL01E), JNL00A_014=if(JNL00A+JNL014<900,0,JNL00A+JNL014), JNL00A_01E=if(JNL00A+JNL01E<900,0,JNL00A+JNL01E), JNL014_01E=if(JNL014+JNL01E<900,0,JNL014+JNL01E) | where JNL000_00A > 900 OR JNL000_014 > 900 OR JNL000_01E > 900 OR JNL00A_014 > 900 OR JNL00A_01E > 900 OR JNL014_01E > 900 | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E ... View more

Hi, i'm very close to solution, i've managed to see a timechart that shows the times where the combined JNLs are above 900, and all i need to do is display it in a hourly interval and display each column count. (timechart span=1h count(transfer_in_MB) by JNL*), but it doesnt work with "*" index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA (JOURNAL_ID="014" OR JOURNAL_ID="00A" OR JOURNAL_ID="000" OR JOURNAL_ID="01E") | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | table _time IDs transfer_in_MB | dedup _time IDs | timechart span=1m avg(transfer_in_MB) by IDs | eval JNL000_00A=if(JNL000+JNL00A<900,0,JNL000+JNL00A),JNL000_014=if(JNL000+JNL014<900,0,JNL000+JNL014), JNL000_01E=if(JNL000+JNL01E<900,0,JNL000+JNL01E), JNL00A_014=if(JNL00A+JNL014<900,0,JNL00A+JNL014), JNL00A_01E=if(JNL00A+JNL01E<900,0,JNL00A+JNL01E), JNL014_01E=if(JNL014+JNL01E<900,0,JNL014+JNL01E) | where JNL000_00A > 900 OR JNL000_014 > 900 OR JNL000_01E > 900 OR JNL00A_014 > 900 OR JNL00A_01E > 900 OR JNL014_01E > 900 | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E ... View more

The graph should display the Number of times (count) 2 fields (when you sum their transfer_in_MB) are greather then 900 and display it in a timechart hourly interval. Thank you for your time and patience! ... View more

but i dont want to see where the counts are bigger then 900, i want to see where the transfer_in_MB of 2 fields together is greater then 900. Thank you! ... View more

Thank you! That "dedup _time IDs" is great. Didnt know you can give him multiple fields. ... View more

Thank you for your answer, i did improve it but after i've opened the case.. im sorry. I have 4 fields in the beggining because they are my main field, but in the end I create 6 fields (which are the combination of the 4 main fields) and work on them. Thanks to somesoni2, the current query looks like: index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA (JOURNAL_ID="014" OR JOURNAL_ID="00A" OR JOURNAL_ID="000" OR JOURNAL_ID="01E") | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB>450 | dedup _time IDs | timechart span=1h count(transfer_in_MB) by IDs | fillnull value="0" JNL000, JNL00A, JNL014, JNL01E | eval JNL000_00A=JNL000+JNL00A, JNL000_014=JNL000+JNL014, JNL000_01E=JNL000+JNL01E, JNL00A_014=JNL00A+JNL014, JNL00A_01E=JNL00A+JNL01E, JNL014_01E=JNL014+JNL01E | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E it's still not working, but at least looks better and preforms better ... View more

Thank you for your command, The last where is not working because each one of the fields consist a count of how many time the transfer_in_MB>450, and it will compare the count to 900 instead of the transfer_in_MB. If i only could do a timechart that shows the transfer_in_MB of each JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E where transfer_in_MB of each of them > 900 it would solve it.. But the Where is used on a single JNL rather then the conbined fields. Thank you for your time and patience! ... View more

I figured out why the problem happends. It can happen if its only 1 hour or less and even if it's the last 10 hours . Because i saw that every "JNL" is sampled a few times in each minute (and it's value stays the same), I cannot use count in a timechart, it will count duplicate values and will show a false result, so I decided to use "dedup _time", but i can only do it if I search for only 1 JNL, because if im searching for more then 1 and do "dedup _time", it will delete the other JNLs rows. So i use appendcols and dedup every JNL by it's own. And then i saw the if the first search before the first "appencols" didnt return any return (which mean it didnt find any result), the _time will go blank for the rest of the search. Do you guys have any suggestion how to deal with that problem? ... View more

I figured out why the problem happends. It can happen if its only 1 hour or less and even if it's the last 10 hours . Because i saw that every "JNL" is sampled a few times in each minute (and it's value stays the same), I cannot use count in a timechart, it will count duplicate values and will show a false result, so I decided to use "dedup _time", but i can only do it if I search for only 1 JNL, because if im searching for more then 1 and do "dedup _time", it will delete the other JNLs rows. So i use appendcols and dedup every JNL by it's own. And then i saw the if the first search before the first "appencols" didnt return any return (which mean it didnt find any result), the _time will go blank for the rest of the search. Do you guys have any suggestion how to deal with that problem? ... View more

Thank you very much for your answer! I've managed to do the first one but the second one (the rename) didn't work. I solved the problem in a different way, i've posted above how. ... View more

This eventually solved the problem, i used this with a combination of "eval token": <table> <title>PAIR JNL Preformance Table (Shows the number of times the PAIR JNLs MB/s is greater then 450 MB)</title> <search> <query>index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL000" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL00A" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL014" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL01E" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | fillnull value="0" JNL000 | fillnull value="0" JNL00A | fillnull value="0" JNL014 | fillnull value="0" JNL01E | eval start_time=_time, end_time=_time+_span | eval JNL000_00A=JNL000+JNL00A, JNL000_014=JNL000+JNL014, JNL000_01E=JNL000+JNL01E, JNL00A_014=JNL00A+JNL014, JNL00A_01E=JNL00A+JNL01E, JNL014_01E=JNL014+JNL01E | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E</query> <earliest>$timeField1.earliest$</earliest> <latest>$timeField1.latest$</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="jnls_mb_counter">$click.name2$</set> <eval token="drilldown.earliest2">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="drilldown.latest2">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval> <eval token="output_field">split($jnls_mb_counter$, "_")</eval> <eval token="JNL1_field">mvindex(output_field, 0)</eval> <eval token="JNL2_field">mvindex(output_field, 1)</eval> </drilldown> </table> </panel> <panel depends="$jnls_mb_counter$"> <chart> <title>Drilldown Selected PAIR JNL MB</title> <search> <query>index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where IDs="$JNL1_field$" | timechart avg(transfer_in_MB) span=1m as "$JNL1_field$ Transfer" | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024 | where JOURNAL_ID="$JNL2_field$" | timechart avg(transfer_in_MB) span=1m as "JNL$JNL2_field$ Transfer"]</query> <earliest>$drilldown.earliest2$</earliest> <latest>$drilldown.latest2$</latest> </search> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">connect</option> </chart> </panel> ... View more

There are 6 columns/fields in the main panel. "JNL000_00A" "JNL000_014" "JNL000_01E" "JNL00A_014" "JNL00A_01E" "JNL014_01E" The person is clicking the value of the column/field in the main panel which triggers a drilldown panel which suppose to display a timechart with 2 lines (the 2 JNLs). For example, if he clicked a value in "JNL000_00A" column/field, it will display a timechart with 2 lines (one is the values of the field JNL000 and another is the values of the field JNL00A). I hope i explained it right. ... View more

Here's the panels (the main one and the second one): <panel> <table> <title>PAIR JNL Preformance Table (Shows the number of times the PAIR JNLs MB/s is greater then 450 MB)</title> <search> <query>index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL000" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL00A" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL014" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL01E" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | fillnull value="0" JNL000 | fillnull value="0" JNL00A | fillnull value="0" JNL014 | fillnull value="0" JNL01E | eval start_time=_time, end_time=_time+_span | eval JNL000_00A=JNL000+JNL00A, JNL000_014=JNL000+JNL014, JNL000_01E=JNL000+JNL01E, JNL00A_014=JNL00A+JNL014, JNL00A_01E=JNL00A+JNL01E, JNL014_01E=JNL014+JNL01E | fields _time,JNL000_00A,JNL000_014,JNL000_01E,JNL00A_014,JNL00A_01E,JNL014_01E</query> <earliest>$timeField1.earliest$</earliest> <latest>$timeField1.latest$</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="jnls_mb_counter">$click.name2$</set> <eval token="drilldown.earliest">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="drilldown.latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval> </drilldown> </table> </panel> <panel depends="$jnls_mb_counter$"> <table> <title>Drilldown Selected JNL MB</title> <search> <query>index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | table _time $jnls_mb_counter$ | eval output_field = split($jnls_mb_counter$, "_") | eval field1=mvindex(output_field, 0) | eval field2="JNL".mvindex(output_field, 1)</query> <earliest>$drilldown.earliest$</earliest> <latest>$drilldown.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> It's a drilldown ... View more

Im sorry for the mistake, i want 2 fields with the name "JNL000" and "JNL01E", not a fields value (Thank you for your answer). I've updated the main comment. ... View more

Hi jplumsdaine22, Im sorry for the mistake, i want 2 fields with the name "JNL000" and "JNL01E", not a fields value (Thank you for your answer). ... View more

A field name, thanks for the correction ... View more

I want the rows of the timechart to be hours (row1=2017-12-13 08:00, row2=2017-12-13 09:00 for example), i need the "span=1h".. Even if the span is static at 1h, if i want to display 2 hours, why would i see blank values in the _time column? ... View more

Can someone help me please? ... View more

Sure: <table> <title>JNL Preformance Table (Shows the number of times a JNLs MB/s is greater then 450 MB)</title> <search> <query>index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL000" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL00A" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL014" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | appendcols [search index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | where transfer_in_MB&gt;450 | search IDs="JNL01E" | dedup _time | timechart span=1h count(transfer_in_MB) by IDs] | fillnull value="0" JNL000 | fillnull value="0" JNL00A | fillnull value="0" JNL014 | fillnull value="0" JNL01E | eval start_time=_time, end_time=_time+_span</query> <earliest>$timeField1.earliest$</earliest> <latest>$timeField1.latest$</latest> </search> <option name="drilldown">cell</option> <drilldown> <set token="jnl_mb_counter">$click.name2$</set> <eval token="drilldown.earliest">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="drilldown.latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval> </drilldown> </table> </panel> Now it worked for some reason (i managed to see 1 line below 1h range... but sometimes it doesnt (and i see the _time column empty), weird ... View more

I still have an issue. The code is working but when the time is above 1h.. When I tell him to show me the last hour or less (30 minutes for example), it shows me the _time column empty.. and the drilldown doesnt work/ My guess is that it doesnt know the earliest or latest.. Thank you for your answer! ... View more

thank you!, i upvoted it, when can i click "accept" on it? ... View more