I have a search which I am using stats to generate a data grid. Something to the affect of Choice1 10 Choice2 50 Choice3 100 Choice4 40 I would now like to add a third column that is the percentage of the overall count. So something like Choice1 10 .05 Choice2 50 .25 Choice3 100 .50 Choice4 40 .20 I suspect I need to use a subsearch for this because each row now depends on the total count but I am not exactly sure how to accomplish this. Any help would be greatly appreciated. ... View more

I am creating some field aliases that I want to apply to multiple sourcetypes. I was hoping to do something like this in props.conf [mysourcetype_*] FIELDALIAS-class = fieldname as alias My thought was this would hopefully apply the alias to the sourcetypes that match that pattern. This didn't appear to work so I resorted to something like this [source::...*...] FIELDALIAS-class = fieldname as alias While this works I have two questions. Is there a way to specify a pattern for the sourcetype like I was trying to do in the first example? What are the performance implications, if any, of the second example, which applies the field alias to all sources? Thanks ... View more

I have a dashboard that uses HiddenSearch and HiddenPostProcess to show 4 line charts. The first two look at 3 monthes worth of events and show the avg and min of a field respectively. The last 2 charts should show 1 monthes worth of data for the same two statistics. I was hoping I could run the HiddenSearch for three monthes worth of data and then have the two 1 month HiddenPostProcess do something like this: <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True"> <param name="search"> sourcetype=perfdata End | fields _time, runtime, class</param> <param name="earliest">-2160h</param> <module name="HiddenPostProcess" layoutPanel="panel_row1_col1"> <param name="search">search earlist=-720h | timechart avg(runtime) by class</param> <module name="HiddenChartFormatter"> <param name="chart">line</param> <param name="chartTitle">Average Runtime 1 Month</param> <param name="primaryAxisTitle.text">time</param> <param name="secondaryAxisTitle.text">Average Runtime</param> <param name="legend.placement">right</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">350px</param> </module> </module> </module> This does not appear to work. Is this possible, or do I need to run a hiddensearch for each timerange? ... View more