Convert the current search to summary index search, schedule the search to run every day 1 am or 2 am to get yesterday's data and store it in summary index.
Create another search to get data from the summary index, and in your dashboard do the search with time chart span=1m for year. the search will be faster.
or
Create a Advanced dashboard with time component so that with custom time you can make your search to run.
... View more
Yes its case sensitive, I dont know some how its not showing my backslash and uppercase were gone i dont know, hopefully this comment displays my search properly...:)
search "OutputProfile-720P" OR "OutputProfile-1080P" NOT "Failed" | rex "OutputProfile-(? \d+\w{1})"| timechart count by mobile_type
... View more
Try this,
search "OutputProfile-720P" OR "OutputProfile-1080P" NOT "Failed" | rex "OutputProfile-(? \d+\w{1})"| timechart count by MOBILE_TYPE
... View more