Why am I unable to write to a new index I have created a new index through the UI, by going to: Settings > Data > Indexes > New Index Filling out the name and then essentially leaving everything else as default. I then wrote a scheduled search to write to this index. The search produces results when I run it in the search bar, and also works when I set it to write to other previously existing indexes. It only doesn't work when I try to write to a newly created index (I have tried with a few). Is there a step I need to do to allow data to be written into a new index? What am I missing here? Thanks, Sam ... View more

Hi, I have a scheduled alert looking at a certain specific event type, which is set to trigger if the 90th percentile time taken goes over a certain amount. As this can happen fairly often, I have set the throttle so that if the alert triggers, it does not do it again for three hours. However, the alert simply ignores the throttle and triggers whenever it wants. The alert has the following conditions: Search: <base search> | eval time_taken_s=time_taken/1000 |stats perc90(time_taken_s) as response_percentile, count as Count Time range: Earliest: rt-60m Latest: rt-0m Condition: If custom condition if met Custom Condition Search: search response_percentile > 20 AND Count > 30 Alert mode: Once per search Throttling: Yes After triggering the alert, don't trigger it again for: 3 Hour(s) If anyone can see what I am doing wrong that would be greatly appreciated. Many thanks, Sam ... View more

I'm plotting some data on a timechart, with a span of a couple of months, and using weeks as the data points. How can I make the chart so it takes a week from Monday-Sunday instead of Thursday-Wednesday? Thanks, Sam ... View more

Hi, If I have a stacked bar graph and I want to display two types of values for each one, how can I make the null (0) values not be displayed like below? Thanks, Sam ... View more

Hi, I have created a dashboard which summaries some results for our customers, and we are interested in auto-generating some PDFs to send to them. In the dashboard we have a drop down where you can select the customer, however, I am aware that to schedule PDF delivery there need to be no drop down options. The issue is that we have over 100 customers and so I do not want to create a dashboard for each one as this would mean if I need to make any changes then it would likely cause some issues. Is there any way to have one dashboard and use this along with a list of the emails and customer names where it can generate a PDF and send it to each customer individually? Thanks, Sam ... View more

Hi, This is a bit of a long one so sorry in advance. I am attempting to time some events which are happening in one of our products, which we can view with IIS logs. Because we want to see how long things are taking on the customers end of things, using the time_taken field gives us a huge under estimate. Essentially we have (as an example) two seperate events which we know mark the beginning and the end of the login process. I'll call them action=login and action=end . The only real distinguishing features between separate login events are the customer and cs_username fields. However, is it possible to add on a distinction between multiple logins of the same person? For example each time customer=A and cs_username=A1 go through action=login it gets assigned a variable, either something unique or a counter of how many times that has happen. Then the same thing for action=end , so these can be paired up and every event monitored. Another important factor that I need to take into account is if someone begins the login process but then it times out, and then they try again. This could look like: - action=login , customer=A , cs_username=A1 , _time=12:00 - action=login , customer=A , cs_username=A1 , _time=12:05 - action=end , customer=A , cs_username=A1 , _time=12:06 Where it would be important to pair the end with the second login, not the first. If anyone has any ideas or has achieved something similar I would really appreciate it. I have beforehand used a search which takes the time difference between events but it can't do it for every login and doesn't account for unfinished actions. Many thanks, Sam ... View more