I have the following data that I'm trying to timechart the differences between: 2023-02-16T16:14:04: Data Processing Phase -1 completed 2023-02-16T14:01:00: Data Processing Phase -1 starting 2023-02-16T14:01:00: Data Collection Phase 3 (Final Collection Phase) completed 2023-02-16T11:34:10: Data Collection Phase 2 starting 2023-02-16T11:34:10: Data Collection Phase 1 completed 2023-02-16T11:34:10: Data Collection Phase 3 (Final Collection Phase) starting 2023-02-16T11:34:10: Data Collection Phase 2 completed 2023-02-16T09:01:36: Data Collection Phase 1 starting   I've sliced up the data using the following SPL, but that will only give me a look at the time differences over the selected timeline.  I can't figure out how to slice this data up so that I'm able to timechart the differences over multiple runs of the Data Collection Phases. | stats first(_time) as End, last(_time) as Start by Phase, PhaseIdentifier | eval RunTime = round((End - Start) / 60, 0) | eval Start=strftime(Start, "%c") | eval End=strftime(End, "%c") | rename RunTime AS "RunTime (Minutes)"   I'm used to working more with metrics and logs that spit out runtimes, so this has been vexing me for entirely too long... ... View more

I am working with a coworker on a dashboard that takes a simple search and automatically shows historical graphs for that search overlaid in the same graph. To this end, we need to make a dropdown for the timechart functions so we can say what function to graph. While I could define them statically, I'd really like to define the timechart functions programmatically, which will enable us to easily 'port' this dashboard to using other commands (like eventstats, stats, etc) without having to recode our dropdowns. tldr; Is it possible to pull the available options for timechart via an SPL search for inclusion into an XML dropdown in a dashboard? ... View more

Hello! If I run this query, I'll get a graph of the # of queries over time aggregated for all of my hosts. host=* | timechart per_minute(Query) If I run this query, I'll have a similar graph with one line shown per host. host=* | timechart per_minute(Query) by host Is there any way to graph by groups of hosts? Say, by the domain of the server. example: host=* | timechart per_minute(Query) by group (a, b, c) where group a like "*.a.com" and group b like "*.b.com" and group c like "*.c.com" ... View more