I have a multisearch to view data for yesterday only.
[search
index=... earliest = -1d@d latest=+0d@d| search ....
]
[search
index=... earliest = -1d@d latest=+0d@d|search ...] |timechart span=30m count BY cat
Running separately the time window is correct, it gives me data for yesterday BUT when running it as a multisearch it gives data for yesterday BUT the x-axis is extended to the current time without any data. I don't want the x-axis to be extended up to the current time.
What is the time range picker value? (I know you're specifying it in-line in search).
What is the time range picker value? (I know you're specifying it in-line in search).
Hi somesoni, It was set to "today", I changed it to "all time" and seems to have done the trick. Cheers.l