Hi guys, I have a daily report dashboard with the below token. However, I need to create another report on the same dashboard with trend for the last - 7 days. How do I create a new token for the last 7 days? If "today" is selected on the time picker, It should search for - 7 days from today? If "yesterday" is selected on the time picker, It should search for - 7 days from yesterday? <input type="time" token="time" searchWhenChanged="true"> <label>Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> <change> <eval token="time.earliest_epoch">if('earliest'="",0,if(isnum('earliest'),'earliest',relative_time(now(),'earliest')))</eval> <eval token="time.latest_epoch">if(isnum('latest'),'latest',relative_time(now(),'latest'))</eval> </change> </input> Thank you! ... View more

Hi Guys, I created lookups and dashboards with lookups using an admin role. Now when other users (no admin role) are viewing the dashboards, all reports with lookups are not working. I made sure that the other users have permission to read the lookups (files, definitions and automatic lookups) but it's still not working. The report will work when I add the "admin_all_objects" capability to those users. However, I cannot let all users to have admin rights to all objects. Is there any other way to fix this? Thanks! ... View more

Hey Guys, I have a daily report that is showing the # of orders planned and completed for the day. However, sometimes the order plan and completion doesn't always happen on the same day. Some of the information that I need are available on when the order is received. Therefore, if the order was completed today but it was received yesterday, these information were lost. I have added earliest=-7d on my query but this is looking back 7 days when the search was done and not 7 days when the event happened. The below query works when we are looking at today's order but when we have to look back at few months report then it doesn't work properly. How can I make it look at 7 days when the event happened? Thanks a lot! | join type=outer BATCHNO [ search index=* source="WCT_4BATCH_STATUS" STATUS=RECEIVED earliest=-7d | eval RFT=strptime(RFT,"%Y-%m-%d %H:%M:%S.%N") | stats max(RFT) as rft by BATCHNO] | join type=outer ORDERNO [ search index=* source="WCT_4DELIVERY_ORDER_STATUS" STATUS=RECEIVED earliest=-7d | rex field=ORDERNO "-(?<ORDERNO>\d+)" | stats values(SIOFLAG) as flag by ORDERNO] ... View more

Hi Guys, When I run the below query, it only returns the eventHour up to 14 (2pm) when there are events up to eventHour 18 (6pm). I tried to add |search eventHour=15,16,17,18 after the |eval eventHour and it returned the stats on those eventHours. What should I do to display the stats on all eventHours? Thank you! ---search--- | eval eventHour=strftime(_time,"%H") | table eventHour STORAGECYCLEGROUPID DESTINATIONRACKLOCATION AISLE BAY LEVEL | sort STORAGECYCLEGROUPID EVENTTS ASC | autoregress STORAGECYCLEGROUPID as SC | eval SC2=(STORAGECYCLEGROUPID-SC) | eval cyclecheck=if(SC2=="0",0,1) | autoregress BAY as BAY2 | eval baycheck=abs(BAY-BAY2) | autoregress LEVEL as LEVEL2 | eval levelcheck=abs(LEVEL-LEVEL2) | eval stops=if(cyclecheck=1 OR baycheck>1 OR levelcheck>0,1,0) | stats max(eventHour) as eventHour sum(stops) as numberofstop by STORAGECYCLEGROUPID | chart count over eventHour by numberofstop | rename 1 as "1 Stop", 2 as "2 Stops", 3 as "3 Stops", 4 as "4 Stops" ... View more

Hey Guys, I have events with duration (seconds), then I chart the sum of duration per week. So now, the field names are the week numbers and the values are the duration. Formatting to[h%:m%:s%] converts my duration to string that is why I can't format the duration before charting. How can I format the duration now to [h%:m%:s%] when my field names (week number) are changing every week? | bin _time span=1w | convert timeformat=("%V") ctime(_time) | chart sum(DURATION) as duration over DESCRIPTION by _time useother=f | addtotals | sort Total desc limit=10 Thank you! ... View more