The timechart  generates time series for selected time range, so you get data for full time window, even when there are no results for certain buckets. The chart command, like stats command, generates statistics for available _time buckets only, so if a time bucket has 0 events, it'll will not show it (can't generate if it's not present). There are workaround to get full time series with chart as well but it's not that pretty. If timechart is an option, use that.  Here is the workaround query: index = _internal ``` simulate zero-count buckets ``` | bucket _time span=5m | chart count over _time | append [| makeresults | addinfo | eval time=mvrange(info_min_time, info_max_time+1,300) | rename comment as "third argument should in seconds and same as the span you selected for chart" | table time | mvexpand time | rename time as _time | eval count=0] | chart sum(count) as count by _time ... View more

Gi <input type="dropdown" token="tok_usecase" searchWhenChanged="true"> <label>Use Case</label> <choice value="&quot;01&quot;">Use Case 01</choice> <choice value="&quot;02&quot;">Use Case 02</choice> <choice value="&quot;03&quot;">Use Case 03</choice> <choice value="&quot;04&quot;">Use Case 04</choice> <choice value="&quot;05&quot;">Use Case 05</choice> <choice value="&quot;06&quot;">Use Case 06</choice> <default>"01"</default> <initialValue>"01"</initialValue> <change> <condition label="Use Case 05"> <set token="ShowPanel">true</set> <unset token="tok_audit"></unset> <unset token="tok_taskID"></unset> <unset token="tok_sessID"></unset> </condition> <condition match="true()"> <unset token="ShowPanel"></unset> <unset token="tok_audit"></unset> <unset token="tok_taskID"></unset> <unset token="tok_sessID"></unset> </condition> </change> </input> ve this a try   ... View more

Your filter to include weekends is "day_of_week=&quot;*&quot;". The asterisk as wildcard doesn't work with "where" command. So either change your search to replace "where" with "search" OR change your include weekend filter. Either Change search to: `compliance("`console`", now(), -15d@d, mcafee,*, virus_, *, *, *)` | eval day_of_week = lower(strftime(_time,"%A")) | search NOT (day_of_week="saturday" OR day_of_week="sunday") | chart count by virus_global | sort virus_global   OR change radio button to: <input type="radio" token="weekends" searchWhenChanged="true"> <label>Weekends</label> <choice value="NOT (day_of_week=&quot;saturday&quot; OR day_of_week=&quot;sunday&quot;)">Exclude Weekends</choice> <choice value="true()">Include Weekends</choice> <default>NOT (day_of_week="saturday" OR day_of_week="sunday")</default> <initialValue>NOT (day_of_week="saturday" OR day_of_week="sunday"). </initialValue> </input>   ... View more

Assuming your value always starts with ESC, give this a try: | rex "value\":\"(?<ESC>ESC[^\"]+)" ... View more

Give this a try my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID | where isnull(mvfind(Date,"02\/20\/23")) ... View more

Give this a try index="va_tools_oit-salesforce" source="sfdc_event_log://EventLog_va_my_salesforce_com_eventlog_va" sourcetype="sfdc:logfile" URL=""https://case.mibams.ba.com/api/ms* | rex field=_raw "\"\"https:\/\/case.mibams.ba.com\/api\/(?<API>[^\/]+\/[^\?\/]+)" | stats count by API | table API ... View more