HI,
I have one dashboard, i've provided drop down option for selecting til last 7 days data. In that drop down list i given present day, yesterday like. But, i want to provide last 7 days dates in that place as my drop-down list input. Is there anyway to do that?
My xml files looks like below
<form>
<label>7 days metrics</label>
<fieldset submitButton="false">
<input type="dropdown" token="TIME_STRING" searchWhenChanged="true">
<label>Select Day</label>
<choice value="earliest=@d latest=now">Today</choice>
<choice value="earliest=-d@d latest=@d">Yesterday</choice>
<choice value="earliest=-2d@d latest=-d@d">2 Days Ago</choice>
<choice value="earliest=-3d@d latest=-2d@d">3 Days Ago</choice>
<choice value="earliest=-4d@d latest=-3d@d">4 Days Ago</choice>
<choice value="earliest=-5d@d latest=-4d@d">5 Day Ago</choice>
<choice value="earliest=-6d@d latest=-5d@d">6 Days Ago</choice>
<choice value="eariiest=-7d@d latest=-6d@d">7 Days Ago</choice>
<default>earliest=@d latest=now</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>$TIME_STRING$
source="path\*" host="my" index="main" | rex "^\s*(?<Type>[^,]+),\s*(?<Category>[^,]+),\s*(?<date>\d{4}-\d{2}-\d{2}),\s*(?<time>\d{2}\:\d{2}),\s*(?<Count>\d+),\s*(?<Cpu_Usage_Percentage>[^,]+),\s*(?<Total_Disk_TB>[^,]+),\s*(?<Used_Disk_TB>[^,]+),\s*(?<Total_Memory_GB>[^,]+),\s*(?<Used_Memory_GB>\S+)"
| table _time Type Category Count Cpu_Usage_Percentage Total_Disk_TB Used_Disk_TB Total_Memory_GB Used_Memory_GB</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Any help on this?
Thanks, all, based on your examples, I've created the following dashboard template for date selection. gentimes can be adjusted to your liking, I'm using gentimes start=-365 end=1 to cover a year
<form theme="dark">
<label>Cascading Date Selector</label>
<fieldset submitButton="false">
<input type="radio" token="day_type" searchWhenChanged="true">
<label>Day Type</label>
<choice value="*">All</choice>
<choice value="day_of_week IN (Mon,Tue,Wed,Thu,Fri)">Business Week (Mon-Fri)</choice>
<choice value="day_of_week IN (Sat,Sun)">Weekends (Sat-Sun)</choice>
<default>day_of_week IN (Mon,Tue,Wed,Thu,Fri)</default>
</input>
<input type="radio" token="year" searchWhenChanged="true">
<label>Year</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>year</fieldForLabel>
<fieldForValue>year</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$
| dedup year
| table year
| sort -year</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="month" searchWhenChanged="true">
<label>Month</label>
<default>*</default>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$
| dedup month
| sort num(month_num)
| table month</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
</input>
<input type="dropdown" token="day_of_week" searchWhenChanged="true">
<label>Day of Week</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>day_of_week</fieldForLabel>
<fieldForValue>day_of_week</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$
| dedup day_of_week
| table day_of_week day_of_week_num
| sort num(day_of_week_num)
| table day_of_week</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="day_of_month" searchWhenChanged="true">
<label>Day of Month</label>
<choice value="*">All</choice>
<fieldForLabel>day_of_month</fieldForLabel>
<fieldForValue>day_of_month</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$
| dedup day_of_month
| sort num(day_of_month)
| table day_of_month</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
</input>
<input type="dropdown" token="date_time_range" searchWhenChanged="true">
<label>Date</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>date</fieldForLabel>
<fieldForValue>time_range</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$ day_of_month=$day_of_month$ $date_time_range$
| table date time_range</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Example query with subsearch to return date ranges as query constraints:</title>
<html>
<strong href="" style="color:white">your base query
[| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range=\"earliest=\"+earliest+\" latest=\"+latest
| eval day_of_week=strftime(starttime,\"%a\")
| eval day_of_month=strftime(starttime,\"%d\")
| eval year=strftime(starttime,\"%Y\")
| eval month=strftime(starttime,\"%b\")
| eval date=strftime(starttime,\"%a %m-%d-%Y\")
| search year="+"$"+"year"+"$"+" month="+"$"+"month"+"$"+" day_of_month="+"$"+"day_of_month"+"$"+" day_of_week="+"$"+"day_of_week"+"$"+" "+"$"+"day_type"+"$"+" "+"$"+"date_time_range"+"$"+"
| table earliest latest
| return 1000 earliest latest]
</strong>
</html>
</panel>
</row>
<row>
<panel>
<title>Dates</title>
<table>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$
| table year month day_of_month day_of_week date time_range</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_week">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
<panel>
<title>Date Constraints Returned</title>
<table>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$
| table earliest latest
| return 1000 earliest latest</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Mate,
Use this in your search query of the dropdown. it gives last 7 days excluding today. And use "Dates" as fieldforLabel and value. It worked for me.
| gentimes start=-7
| eval Dates=strftime(starttime,"%Y-%m-%d")
| table Dates
@prathapkcsc
If it is resolved, accept and/upvote any of the replies which helped you.
index=indexname earliest=-7d@d
| eval Time=strftime(_time,"%m/%d/%Y")
| bin span=1d Time
| stats count by Time
| sort -Time
Valid answer. Could be slow for large datasets. Same query with tstats
| tstats count where index=indexname earliest=-7d@d by _time
| bucket _time span=1d
| eval Time=strftime(_time,"%m/%d/%Y")
| stats count by Time
| sort -Time
Hi prathapkcsc,
This run everywhere example should work:
<form>
<label>7 days metrics</label>
<fieldset submitButton="false">
<input type="dropdown" token="TIME_STRING" searchWhenChanged="true">
<label>Select Day</label>
<choice value="earliest=@d latest=now">Today</choice>
<choice value="earliest=-d@d latest=@d">Yesterday</choice>
<choice value="earliest=-2d@d latest=-d@d">2 Days Ago</choice>
<choice value="earliest=-3d@d latest=-2d@d">3 Days Ago</choice>
<choice value="earliest=-4d@d latest=-3d@d">4 Days Ago</choice>
<choice value="earliest=-5d@d latest=-4d@d">5 Day Ago</choice>
<choice value="earliest=-6d@d latest=-5d@d">6 Days Ago</choice>
<choice value="eariiest=-7d@d latest=-6d@d">7 Days Ago</choice>
<default>earliest=@d latest=now</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
index="_internal" $TIME_STRING$
| rex "^\s*(?<Type>[^,]+),\s*(?<Category>[^,]+),\s*(?<date>\d{4}-\d{2}-\d{2}),\s*(?<time>\d{2}\:\d{2}),\s*(?<Count>\d+),\s*(?<Cpu_Usage_Percentage>[^,]+),\s*(?<Total_Disk_TB>[^,]+),\s*(?<Used_Disk_TB>[^,]+),\s*(?<Total_Memory_GB>[^,]+),\s*(?<Used_Memory_GB>\S+)"
| table _time Type Category Count Cpu_Usage_Percentage Total_Disk_TB Used_Disk_TB Total_Memory_GB Used_Memory_GB
</query>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
I removed the earliest
and latest
option from the search and also changed the XML to use <
for <
and the >
for >
.
hope this helps ...
cheers, MuS
You don't get my question.
I want to provide dates in drop-down list instead of today,1 day ago,2 days ago etc.
i want to give dates as drop-down list input.
ah I see .... let me have a look ....
Updated my previous example to use tokens as input for the date ranges.
<form theme="dark">
<label>Cascading Date Selector</label>
<fieldset submitButton="false">
<input type="radio" token="day_type" searchWhenChanged="true">
<label>Day Type</label>
<choice value="*">All</choice>
<choice value="day_of_week IN (Mon,Tue,Wed,Thu,Fri)">Business Week (Mon-Fri)</choice>
<choice value="day_of_week IN (Sat,Sun)">Weekends (Sat-Sun)</choice>
<default>day_of_week IN (Mon,Tue,Wed,Thu,Fri)</default>
</input>
<input type="radio" token="year" searchWhenChanged="true">
<label>Year</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>year</fieldForLabel>
<fieldForValue>year</fieldForValue>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort -starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$
| dedup year
| table year
| sort -year</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="month" searchWhenChanged="true">
<label>Month</label>
<default>*</default>
<fieldForLabel>month</fieldForLabel>
<fieldForValue>month</fieldForValue>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$
| dedup month
| sort num(month_num)
| table month</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<choice value="*">All</choice>
</input>
<input type="dropdown" token="day_of_week" searchWhenChanged="true">
<label>Day of Week</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>day_of_week</fieldForLabel>
<fieldForValue>day_of_week</fieldForValue>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort -starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$
| dedup day_of_week
| table day_of_week day_of_week_num
| sort num(day_of_week_num)
| table day_of_week</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="day_of_month" searchWhenChanged="true">
<label>Day of Month</label>
<choice value="*">All</choice>
<fieldForLabel>day_of_month</fieldForLabel>
<fieldForValue>day_of_month</fieldForValue>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort starttime
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$
| dedup day_of_month
| sort num(day_of_month)
| table day_of_month</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
</input>
<input type="dropdown" token="date_time_range" searchWhenChanged="true">
<label>Date</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>date</fieldForLabel>
<fieldForValue>time_range</fieldForValue>
<search>
<query>| gentimes start=-365 end=1
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_week_num=strftime(starttime,"%w")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval month_num=strftime(starttime,"%m")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search $day_type$ year=$year$ month=$month$ day_of_week=$day_of_week$ day_of_month=$day_of_month$ $date_time_range$
| table date time_range</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="text" token="days_to_look_back" searchWhenChanged="true">
<label>Days to look back 365=1 year</label>
<default>365</default>
</input>
<input type="text" token="days_to_look_forward" searchWhenChanged="true">
<label>Days to look forward 1=Today</label>
<default>1</default>
</input>
</fieldset>
<row>
<panel>
<title>Example query with subsearch to return date ranges as query constraints:</title>
<html>
<strong href="" style="color:white">your base query
[| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range=\"earliest=\"+earliest+\" latest=\"+latest
| eval day_of_week=strftime(starttime,\"%a\")
| eval day_of_month=strftime(starttime,\"%d\")
| eval year=strftime(starttime,\"%Y\")
| eval month=strftime(starttime,\"%b\")
| eval date=strftime(starttime,\"%a %m-%d-%Y\")
| search year="+"$"+"year"+"$"+" month="+"$"+"month"+"$"+" day_of_month="+"$"+"day_of_month"+"$"+" day_of_week="+"$"+"day_of_week"+"$"+" "+"$"+"day_type"+"$"+" "+"$"+"date_time_range"+"$"+"
| table earliest latest
| return 1000 earliest latest]
</strong>
</html>
</panel>
</row>
<row>
<panel>
<title>Dates</title>
<table>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$
| table year month day_of_month day_of_week date time_range</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">100</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="year">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_month">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
<format type="color" field="day_of_week">
<colorPalette type="sharedList"></colorPalette>
<scale type="sharedCategory"></scale>
</format>
</table>
</panel>
<panel>
<title>Date Constraints Returned</title>
<table>
<search>
<query>| gentimes start=-$days_to_look_back$ end=$days_to_look_forward$
| sort -starttime
| eval earliest=starttime
| eval latest=endtime
| eval time_range="earliest="+earliest+" latest="+latest
| eval day_of_week=strftime(starttime,"%a")
| eval day_of_month=strftime(starttime,"%d")
| eval year=strftime(starttime,"%Y")
| eval month=strftime(starttime,"%b")
| eval date=strftime(starttime,"%a %m-%d-%Y")
| search year=$year$ month=$month$ day_of_month=$day_of_month$ day_of_week=$day_of_week$ $day_type$ $date_time_range$
| table earliest latest
| return 1000 earliest latest</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>