When using index=blah | sitimechart dc(field1) by field2 It saves every single element for field1 concatenated into a new field called psrsvd_vm_field1. For me this makes for an insanely inefficient summary index with millions and millions of useless entries in the psrsvd_vm_field1 field. How can I streamline this so that it doesn't store all that information and have to sort through it every time I chart the summarized data. ... View more

I have this search below, which is incredibly slow because it has to scan the entire index and run the eval on millions of records. There is no need however; I only need the most recent event per source, host pair. The append and join is purely to make sure I can easily spot cases where there are no events. Time picker doesn't really work as some sources have a much lower frequency than others, I'd really like to just select the most recent event for each source and host. index="blah" host=asdf-* | eval delta=now()-_time | append [| metadata type=hosts | search host=asdf-* | eval join=1 | join max=0 join [| metadata type=sources | search source=asdf*.log| eval join=1] | fields + host,source] | stats min(delta) as "seconds_since_last_event" by host source | where seconds_since_last_event>1800 OR isnull(seconds_since_last_event) ... View more

I need a timechart that counts the number of distinct fieldx where that fieldx has more than x events in that span/bin. I hope that makes sense, so sudocode would be something like index=blah | stats count by fieldx as blah | where blah>5 |timechart span=1hr count distinct by fieldx That search obviously doesn't work, I'm not sure how to structure it to get what I want. ... View more

In the search below I have appended two identical searches that are 1 week apart. I would like to find the difference in percent between the two over time. I am aware of the timewrap function but that's not exactly sure how it could help here. A timechart of percentage difference would be ideal. index="blah" earliest=-192h latest=-168h | setfields when='1 week ago' | eval _time = _time+604800 | append [search index="blah" earliest=-24h latest=now | setfields when='0 week ago'] ... View more

index="things" AND sourcetype="user_pixel" AND os="*" | search page = "Contact Us" | timechart span=3hr count by os limit=7 Vs index="things" AND sourcetype="user_pixel" AND os="*" | search page in ("Contact Us") | timechart span=3hr count by os limit=7 The first search gives many results as expected, the second gives nothing. My ultimate goal is to use a dashboard multi-select to apply this filter. However; first I need to get the "in" function to work correctly. What am I doing wrong? ... View more