Hi micahkemp This is what i have - which errors with invalid earliest time. SM_Test <query> <![CDATA[| makeresults | addinfo | eval earliest7=info_min_time-7*24*3600, latest7=if(info_max_time="+Infinity", now()-7*24*3600, info_max_time-7*24*3600)]]> </query> <done> <condition match="'job.resultCount' == 1"> <set token="earliest7">$result.earliest7$</set> <set token="latest7">$result.latest7$</set> </condition> </done> <input type="time" token="field1" searchWhenChanged="true"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <panel> <table> <title>xyz</title> <search> <query>host="xxx-xxx-xxx" sourcetype="alarm_metric" |spath "Message.SourceApp" | search "Message.SourceApp"=xyz | eval spath='Message.EventMessage' | rex field=spath "took (?P&lt;elapsed&gt;\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="This Time 7 Days Ago" | append [search host="xxx-xxx-xxx" sourcetype="alarm_metric" $earliest$ $latest$ | spath "Message.SourceApp" | search "Message.SourceApp"=xyz | eval spath='Message.EventMessage' | rex field=spath "took (?P&lt;elapsed&gt;\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="Today"] | chart count by elapsed span=1 ReportKey</query> <earliest>$earliest7$</earliest> <latest>$latest7$</latest> </search> <option name="drilldown">none</option> </table> </panel> Thanks Sean ... View more

Hi micahkemp, Thanks for the advice. However i can not actually get it work. Not sure what i am missing but i either get invalid start time or waiting for input when i am trying to get it to work. Thanks Sean ... View more

Hi nyabykh, Even with it explained a little bit more i can not get either to work. I have tried various permutations of following both advice but either getting waiting for input or invalid start time. Thanks Sean ... View more

Hi Nryabykh, Thanks for the reply. tbh i tried it with and without the m and could not get it to play 😞 I have also tried to add your suggestions but without success. I have added my panel and start of the form:- SM_Test <input type="time" token="field1" searchWhenChanged="true"> <label></label> <default> <earliest>-15m</earliest> <latest>now</latest> </default> </input> <init> <set token="earliest7">$result.$earliest7$</set> <set token="latest7">$result.$latest7$</set> </init> <panel> <table> <title>Test App</title> <search> <query>makeresults | addinfo | eval earliest7=info_min_time-7*24*3600, latest7=if(info_max_time="+Infinity", now()-7*24*3600, info_max_time-7*24*3600) host="xxx-xxx-xxx" sourcetype="alarm_metric" earliest=earliest7$ latest=latest7$ | spath "Message.SourceApp" | search "Message.SourceApp"=xxxx | eval spath='Message.EventMessage' | rex field=spath "took (?P&lt;elapsed&gt;\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="This Time 7 Days Ago" | append [search host="xxx-xxx-xxx" sourcetype="alarm_metric" earliest=$field1.earliest$ latest=$field1.latest$ | spath "Message.SourceApp" | search "Message.SourceApp"=xxxx | eval spath='Message.EventMessage' | rex field=spath "took (?P&lt;elapsed&gt;\S+)" | eval elapsed = elapsed/1000 | table _time spath, host elapsed | eval ReportKey="Today"] | chart count by elapsed span=1 ReportKey</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="drilldown">none</option> </table> </panel> Using the above i get an error stating "Search is waiting for input...." Not sure where i am going wrong. Thanks Sean ... View more

Hi Martin, I changed it slightly to suit my needs but many thanks for your help. index=alarm* host="" Message.EventCategory="Error" OR "ERROR" | stats count as Error| eval Events= [search "" | stats count as search] | eval "Error Percentage" = (Error/Events)*100 | fields Events Error "Error Percentage" ... View more

Hi Martin, It appears that my version of Splunk (5.0.5, build 179365) will not work with tstats as this was introduced in version 6. I have amended the search as below: index=* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as Error | appendcols [stats count by _time | timechart count] | eval "Error Percentage" = error / count * 100 | fields Error Count Percentage but this only brings back results for the errors 😞 ... View more

Hi Martin, Thanks for the quick reply. I have tried to run this but it throws the following error:- Error in 'TsidxStats': Missing 'FROM' keyword to specify namespace. I am still looking at this but do you have any ideas? Thanks Sean ... View more