The following works fine in the Search app:   ... | makemv delim=";" hashes | ...   The equivalent curl call   curl ... -d search="search ... | makemv delim=\";\" hashes | ..." -d output_mode=csv   fails with an "Unbalanced quotes" error.  Delimiters other than ; work fine. I tried to escape the semicolon, use Unicode values, replace the string with a variable, all to no avail. Any suggestions? ... View more

I'd  love to be able to dynamically adjust the timespan in  a sparkline, as in   ...| eval timespan=tostring(round((now()-strptime("2023-07-26T09:45:06.00","%Y-%m-%dT%H:%M:%S.%N"))/6000))+"m" | chart sparkline(count,timespan) as Sparkline, count by src_ip   However, sparklines do not accept timespans in string format, and the example above results in the following error message:   Error in 'chart' command: Invalid timespan specified for sparkline.   Any suggestions? I see that this question was asked back in 2019, but I couldn't find the answer. ... View more