Hi Can I check if there is a way to split my chart according to a time stamp? This is my code: DESCRIPTION="* sump *" OR (DESCRIPTION="* ejector pump *" AND DESCRIPTION="* run/stop *") (VALUE="RUN" OR VALUE="STOP" OR VALUE="TRIP") | eval TIMEONLY =strptime(CREATEDATETIME ,"%d/%m/%Y %I:%M:%S %p") | eval _time=TIMEONLY | rex field=VALUE mode=sed "s/TRIP/STOP/g" | rex field=DESCRIPTION mode=sed "s/Trip/Run\/Stop/g" | rex field=ASSET_NAME "^(?<LOCATION>[^/]+)" | streamstats count(eval(VALUE="STOP")) AS TransactionID BY ASSET_NAME DESCRIPTION LOCATION | stats range(_time) AS duration list(VALUE) AS VALUES min(_time) AS _time BY TransactionID ASSET_NAME DESCRIPTION LOCATION | stats sum(duration) AS ActiveTime BY LOCATION | head 10 | sort by -ActiveTime What this does to get the operating time of all my pumps and sum them up together, but i would like to see the sum of my operating time month by month is there a query which i can use so that they are able to be shown monthly? the first picture is my bar chart, the second picture is what i wish to see , i was thinking of using timechart but i am not sure what is the correct syntax to be use. i had tried using "timechart span=1d count by LOCATION " but no result were found hope someone understand what i mean and could help me out thanks. ... View more

Hi my code is as follows: DESCRIPTION="* sump *" OR (DESCRIPTION="* ejector pump *" AND DESCRIPTION="* run/stop *") (VALUE="RUN" OR VALUE="STOP" OR VALUE="TRIP") ASSET_NAME="*TAM/*" | eval TIMEONLY =strptime(CREATEDATETIME ,"%d/%m/%Y %I:%M:%S %p") | eval _time=TIMEONLY | rex field=VALUE mode=sed "s/TRIP/STOP/g" | rex field=DESCRIPTION mode=sed "s/Trip/Run\/Stop/g" | rex field=ASSET_NAME "^(?<LOCATION>[^/]+)" | streamstats count(eval(VALUE="STOP")) AS TransactionID BY ASSET_NAME DESCRIPTION | stats range(_time) AS duration list(VALUE) AS VALUES min(_time) AS _time BY TransactionID ASSET_NAME DESCRIPTION | eval newfield=if(duration>=1800,1,null) | sort by ASSET_NAME part of result i get: i would like to ask if there is a code which i can write so that under my description it can check that my Pumps are always working in alternating example  STN DR Sump Pump 01 Run/Stop Status: DR Pump RM 01  run and stop follow by  STN DR Sump Pump 02 Run/Stop Status: DR Pump RM 01 then  STN DR Sump Pump 01 Run/Stop Status: DR Pump RM 01 if there happen that the run/stop did not alternate it will have an alert or flag out abnormally or something ... View more

Hi i would like to check is there a way to hide my chart before i select my ASSET_NAME from the dropdown box, example the picture below is my initial startup dashboard but the chart on my right does not make sense only after i select any of my chart on the left then the right chart will make sense so my question is there a way to mask of the initial search?  if ASSET_NAME : ALL is selected my chart on the right should be blank . , if there is other selection it will show the result thanks ... View more

hi i had made a stats table base on below command and under my visualization is : i would like to ask if there is a way to have additional information at the X-axis example the current X axis have the DESCRIPTION and count(VALUE), but i would like to have the VALUE (RUN and STOP) information inside too ... View more

in my look up table there is my maintenance date which i would like to remove it in my event is there a way that i can remove the event without deleting it from the index? above is my sample data , below is my maintenance date is there a way that i can filter out my event from my lookup data so that those date which appear in my lookup table will not be seen in my event. hope you all can understand what i mean. thanks. ... View more