Can you do the timechart in your original search template and then only post process for the stats? Something like this: <searchTemplate>your search | timechart count span=$span$ $aggr$</searchTemplate> <searchPostProcess>stats count</searchPostProcess> Or is it that you only want to aggregate on the timechart, but not the stats chart? What kind of values are you using for $aggr$? Alternately, the problem might be that the field being used for $aggr$ is not present in your postprocess. So perhaps adding all the possible fields from your dropdown to the search template will help. Something like this: <searchTempate>your search | fields aggrfield1 aggrfield2 ...</searchTemplate> ... View more

Interestingly, in 4.3.1, when I use this for the cli (which works fine in the GUI): table a b c d e I get these results: a d e b c Why would table return fields in a different order from the CLI? ... View more

@jgauthier - He's saying instead of doing a single searchTemplate and then searchPostProcess for each chart, get rid of searchPostProcess and do a searchTemplate within each chart. It means you're going to run more searches, but ultimately will be able to surpass the 10,000 event limit. ... View more

Disregard. I had to change "splitSeries" to false. Worked great. Thanks! ... View more

That got the chart showing again, but with sparklines. It's no longer honoring stackmode: "stacked" ... View more

Same problem here... <form> <label>Class Miner v2.0</label> <searchTemplate>index="*" | fillnull value=NULL | search $name$ $class$ $grade$</searchTemplate> <fieldset> <input type="dropdown" token="name"> <populatingSearch fieldForValue="name" fieldForLabel="name"><![CDATA[index="summary_names" | fields name | dedup name | sort name ]]></populatingSearch> <prefix>name="</prefix> <suffix>"</suffix> <choice value="*">Any</choice> <default>Any</default> </input> <input type="dropdown" token="class"> <prefix>class="</prefix> <suffix>"</suffix> <choice value="*">Any</choice> <choice value="CS">CompSci</choice> <choice value="EN">English</choice> <choice value="HI">History</choice> <choice value="MA">Math</choice> <default>Any</default> </input> <input type="dropdown" token="grade"> <populatingSearch fieldForValue="grade" fieldForLabel="grade"><![CDATA[index="summary_grades" | fields grade | dedup grade | sort grade]]></populatingSearch> <prefix>grade="</prefix> <suffix>"</suffix> <choice value="*">Any</choice> <default>Any</default> </input> </fieldset> <row> <chart> <title>Grades By Class</title> <searchPostProcess>search class!="Unknown"| timechart count by class</searchPostProcess> <option name="charting.chart">area</option> <option name="charting.legend.placement">right</option> <option name="charting.chart.stackMode">stacked</option> <option name="charting.layout.splitSeries">True</option> </chart> </row> </form> ... View more

In 4.2.4 Free License this does not seem to work. ... View more

Thanks Ayn. I did indeed check the docs prior to posting and what I think is the problem is "4. If no events in a source have a date, look in the source (or file) name (Must have time in the event)." Specifically, my events have no timestamps. It's just a summary of items for a 24 hour period. So it seems to be defaulting to #5 or #6. Is there a workaround to force date extraction without timestamps? Or a way to force a timestamp of 00:00 without scripting input? ... View more