Yeah...tried that. No go. Noticed this in the logs though:
Skipping dynamic group "group name" with no values for member attribute.
Instance is still not seeing users 😕
... View more
Mine was geared towards enabling the later commands that you will surely be interested in doing. You can look at the Job Inspector to compare efficiencies.
... View more
Not sure if I understand your requirements correctly... here's what I think you want:
grab the event for the specified date
grab the next (for example) 3 events that happened after that - might be the next three days, might have gaps
return the original event's date and base value as well as the maximum max value over all four events
Since there's no way or knowing how far in the future you need to look to get the next three events you could do something like this run over a timerange from the specified date to now:
your base search | tail 4 | stats earliest(Date) as Date earliest(Base) as Base max(Max) as Max
If your specified date is far into the past and there's a lot of data since then this would churn through all of the data and discard most of them - so if possible you can specify a latest time closer to the specified date but far away enough to be sure there will be another three events in there.
... View more
If your log event is
2012-01-05,28.38,28.50,28.25,28.25,362800,2.48
and you have TIME_FORMAT properly defined in your props.conf file then follow the approach that wpreston has suggested.
... View more