Hello I am a bit unclear from the readings the meaning of  'latest_day and 1 day_ before'. I have attached a screen shot where I am comparing a particular event that occurred over 7 days.  Now if I want to compare say   'latest_day and 1 day_ before'. : is latest like yesterday and 1day_ before is the 4th October? I am confused. My query:  index="AB" earliest=-8d@d latest=@d | search status="OTP_REQUIRED" | timechart span=1h count | timewrap d |  fields _time latest_day, 1day_before ( when I want to compare days) Thankyou ... View more

hello everyone Now I have been getting cluster Maps and Choropleth Maps generated , but a few issues with them. q1.when I add the same command from search app to the panel in the dash I loose all the state/regions names too!! works with the zoom function, is that ok? 2.  query: why do I have multiple tiles of the same regions running through how can I just create the view where I can see regions only where events have occurred? Screenshot attached I know the legend doesn't match the map as values show 0, but they change and seem to be ok after 10/15 mins, I dont know why!! I am trying to search for failed/successful applications logins by region/city/or country. my query:   index=a sourcetype=ab | iplocation ip | search status=failure AND connectionname=" ABwebsite" | stats count by Country| geom geo_countries allFeatures=True featureIdField=Country   if I don't add ip, no values populate on the map, there's just color.   Thankyou for looking into the query.   ... View more

Hello All I have been asked to show trends for business requirement with the dataset I have. Possible past, present and 'possible' predict for 3\4 months. the only _time dataset I have is the "WeekStarting": where events have occurred. To make it more relatable I need to show trends in login sharing.  Due to the magnitude of data, to make more sense out of the values I have selected 3 quarters over 3 years i.e (WeekStarting="2020-07-20" OR WeekStarting="2020-08-24" OR WeekStarting="2020-09-28" OR WeekStarting="2021-07-26" OR WeekStarting="2021-08-23" OR WeekStarting="2021-09-20" OR WeekStarting="2022-06-20" OR WeekStarting="2022-07-18" OR WeekStarting="2022-08-22" ). Now I don't have any day or any time series data which makes it difficult for me to make timechart or timewrap commands.  What I have used so far and many others: index="AB" sourcetype="AB" | spath | search (WeekStarting="2020-07-20" OR WeekStarting="2020-08-24" OR WeekStarting="2020-09-28" OR WeekStarting="2021-07-26" OR WeekStarting="2021-08-23" OR WeekStarting="2021-09-20" OR WeekStarting="2022-06-20" OR WeekStarting="2022-07-18" OR WeekStarting="2022-08-22" ) | stats values(TotalUsers) , values(DeviceTypes{}), values(WeekStarting), sum(Newbrowsertypes) as Aggregate_Logins by AccountID | where Aggregate_Logins >=5 I do know these are not trend commands. But I am really lost as to how I can incorporate trends with the dataset. Please help!! ... View more