I'm trying to make a form where I can select a host, and then get various kinds of perfmon & wmi info about it. So far, I can get it to dump data into normal line charts, but if I try to get it to dump data into a radial gauge, the gauge doesn't show and the following message is displayed instead: Search did not generate any statistical results. Here's a screenshot of the form running. Here's the code of my form. <?xml version='1.0' encoding='utf-8'?> <form> <label>Server Performance - Detailed</label> <searchTemplate>host="$host$" AND (sourcetype="Perfmon*" OR sourcetype="WMI*") | fields + host, counter, sourcetype, instance, Value</searchTemplate> <earliestTime>rt-30m</earliestTime> <latestTime>rt</latestTime> <fieldset> <input type="radio" token="host"> <label>Select Host</label> <populatingSearch fieldForValue="host" fieldForLabel="host">sourcetype="Perfmon*" OR sourcetype="WMI*" earliest="-60m" latest="now" | dedup host | table host | sort host</populatingSearch> </input> </fieldset> <row> <chart> <searchPostProcess>where sourcetype="Perfmon:LogicalDisk" AND counter="% Disk Read Time" AND NOT instance="_Total" | stats last(Value) AS lastValue by instance | stats max(lastValue) AS maxValue | gauge maxValue</searchPostProcess> <title>test</title> <option name="charting.chart">radialGauge</option> <option name="charting.chart.style">shiny</option> </chart> <table> <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | stats last(Value) AS Value by instance | stats max(Value) AS Value</searchPostProcess> <title>test</title> </table> </row> <row> <chart> <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Write Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess> <title>% Disk Write Time</title> <option name="chartTitle">% Disk Write Time</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">zero</option> <option name="charting.legend.placement">top</option> <option name="drilldown">none</option> <option name="primaryAxisTitle.text">Time</option> <option name="secondaryAxisTitle.text">% Write Time</option> <option name="charting.scaleX">1</option> </chart> <chart> <searchPostProcess>search sourcetype="Perfmon:LogicalDisk" counter="% Disk Read Time" NOT instance="_Total" | timechart avg(Value) by instance</searchPostProcess> <title>% Disk Read Time</title> <option name="chartTitle">% Disk Read Time</option> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">zero</option> <option name="charting.legend.placement">top</option> <option name="drilldown">none</option> <option name="primaryAxisTitle.text">Time</option> <option name="secondaryAxisTitle.text">% Read Time</option> <option name="charting.scaleX">1</option> </chart> </row> </form> ... View more

I'm having a problem getting web intel app showing any results. I've investigated a bit, and think the problem is the column names I used. This is what I currently have set: iislogs FIELDS = "date", "time", "s_siteName", "s_computername", "dest_ip", "http_method", "uri_stem", "uri_query", "dest_port", "user", "src_ip", "http_user_agent", "http_cookie", "http_referrer", "dest_host", "http_response", "http_sub_response", "sc_win32Status", "bytes_out", "bytes_in", "duration" DELIMS = " " What column names does web intel expect me to have? ... View more

I'm trying to generate a table that is a count of things by the 12 months of the year. For instance, the chart might look like: |Jan|Feb|Mar|Apr|...|Dec| |Thing1| 15|102| 67|645|...| 0| |Thing2| 0| 17|111| 15|...| 8| |Thing3| 1|555|123|321|...|999| etc... I've figured out how to do this my making the output verticle; count of things in a month, followed by the count of things in the next month and so on. I want to be able to stack the months horizontally. Thanks in advance. ... View more

I need help figuring out how to store visitor session info into a summary index. First, what I want to be able to do: query the summary index and return how many visitor sessions our site had in x-time. Also, I want to return how many visitor sessions a particular path has /path/y with x-time. I tried building a saved search that wrote to the summary index; web events transactioned by ip & user agent: host="webserver" | transaction ip UserAgent maxspan=30m | stats values(uri_stem) by ip UserAgent This appeared to work until I noticed that each day had exactly 10,000 visitor sessions. The query was hitting a limit. This made me realize that dumping all of the data into the summary index doesn't actually gain me anything, since nothing is being summarized 🙂 The other way I thought about was to calculate the # of visitor sessions per day, and save that into the summary index. The problem here is that I would only be able to tell how many sessions there were for the whole site; I couldn't get sessions for just a subsection. Any ideas on how to get both searches to work from the same summary index data? I don't want to have to setup a new summary index search every time someone thinks of something new to search for. Thanks! ... View more