I should add that time bins are selected through a time picker so they can't be saved times in the query. Can we work around this? ... View more

Thank you for the reply Giuseppe, Hi am still getting black fields when using appendpipe. ... View more

This returns an empty field    ... View more

The lookup only contains counts as seen in the table I have in the original post. My problem is I can't use earliest and latest commands to view historical data week by week. ... View more

Hi bowesmana,    How can I use  | where _time>=info_min_time AND _time<=info_max_time  to only display data from last 7 days (one week) if inputlook does not accept earliest and latest? ... View more

| multisearch [ search index=xxx sourcetype=xxx xxx earliest=$earliestTime$ latest=$latestTime$ | eval label=xxx | fields -_raw _time ecn label ] [ search index=xxx sourcetype=xxx xxx earliest=$earliestTime1$ latest=$latestTime1$ | eval _time=_time+60*60*24*7 | eval label=xxx  | fields -_raw _time ecn label ] [ search index=xxx sourcetype=xxx xxx earliest=$earliestTime2$ latest=$latestTime2$ | eval _time=_time+60*60*24*14  | eval label=xxx  | fields -_raw _time ecn label ] [ search index=xxx sourcetype=xxx xxx earliest=$earliestTime3$ latest=$latestTime3$ | eval _time=_time+60*60*24*21  | eval label=xxx  | fields -_raw _time ecn label ] [ search index=xxx sourcetype=xxx xxx earliest=$earliestTime4$ latest=$latestTime4$ | eval _time=_time+60*60*24*28  | eval label=xxx  | fields -_raw _time ecn label ] | bin _time span=5m | chart dc(ecn) over _time by label ... View more

Hey @dindu can you provide this as a example using the XML code I provided? thanks ... View more

Ive added the code for the text boxes, drop down box and submit button below. XX <input type="text" token="startdate" searchWhenChanged="false"> <label>Start Date (mm/dd/yyyy hh:mm)</label> <default></default> <change> <condition> <eval token="new_earliest">strptime(startdate,"%m/%d/%Y %H:%M %p")</eval> <eval token="new_earliest1">strptime(startdate,"%m/%d/%Y %H:%M %p")-604800</eval> <eval token="new_earliest2">strptime(startdate,"%m/%d/%Y %H:%M %p")-1209600</eval> <eval token="new_earliest3">strptime(startdate,"%m/%d/%Y %H:%M %p")-1814400</eval> <eval token="new_earliest4">strptime(startdate,"%m/%d/%Y %H:%M %p")-2419200</eval> </condition> </change> </input> <input type="text" token="enddate" searchWhenChanged="false"> <label>End Date (mm/dd/yyyy hh:mm)</label> <default></default> <change> <condition> <eval token="new_latest">strptime(enddate,"%m/%d/%Y %H:%M %p")</eval> <eval token="new_latest1">strptime(enddate,"%m/%d/%Y %H:%M %p")-604800</eval> <eval token="new_latest2">strptime(enddate,"%m/%d/%Y %H:%M %p")-1209600</eval> <eval token="new_latest3">strptime(enddate,"%m/%d/%Y %H:%M %p")-1814400</eval> <eval token="new_latest4">strptime(enddate,"%m/%d/%Y %H:%M %p")-2419200</eval> </condition> </change> </input> <input type="dropdown" token="field1"> <label>X</label> <choice value="A">A</choice> <choice value="B">B</choice> <choice value="C">C</choice> <choice value="D">D</choice> <choice value="E">E</choice> <choice value="F">F</choice> <choice value="G">G</choice> <choice value=”H">H</choice> <default>A</default> <change> <condition value="A"> …………………………………………………………………………………………………………………………………….. </condition> </change> </input> ... View more

Hey @arjunpkishore5 The dashboard works but say when I select Date & Range Between 11/13/2019 9:00 and 11/13/2019 10:00 what happens is that the table will display time for 8:00 to 10:00 but it fills in all the data between 8 and 9 with 0s for the first 2 columns, and than it starts to display all the data for 9 to 10. I need it to select the exact time and display it. My guess is that the issue is coming from the way the tokens are set on the dashboard? Any idea on how to fix this issue? <eval token="earliestTime">if(isstr(earliest), relative_time(now(),earliest), earliest)</eval> <eval token="latestTime">if(isstr(latest), relative_time(now(),latest), latest)</eval> <eval token="earliestTime1">relative_time(earliestTime,"-7d")</eval> <eval token="latestTime1">relative_time(latestTime,"-7d")</eval> <eval token="earliestTime2">relative_time(earliestTime,"-14d")</eval> <eval token="latestTime2">relative_time(latestTime,"-14d")</eval> <eval token="earliestTime3">relative_time(earliestTime,"-21d")</eval> <eval token="latestTime3">relative_time(latestTime,"-21d")</eval> <eval token="earliestTime4">relative_time(earliestTime,"-28d")</eval> <eval token="latestTime4">relative_time(latestTime,"-28d")</eval> </change> ... View more

Say I enter 11/12/2019 8:00.000 to 10:00.000, all the data between these 2 times is displayed which is fine, but other times instead of displaying data between 8 and 10 it will display it from 7 to 9. The server is running on ET. ... View more

Hey wmyersas Thank you for your reply but the problem we run into is that the search works sometimes and not other times. We do not think it is a time zone issue. If its a timezone issue it would not work at anytime. ... View more

Below is the source code XX <input type="time" token="time_finder" searchWhenChanged="true"> <label>Time Picker</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> <change> <eval token="earliestTime">if(isstr(earliest), relative_time(now(),earliest),"-0d")</eval> <eval token="latestTime">if(isstr(latest), relative_time(now(),latest), "-0d")</eval> <eval token="earliestTime1">relative_time(earliestTime,"-7d")</eval> <eval token="latestTime1">relative_time(latestTime,"-7d")</eval> <eval token="earliestTime2">relative_time(earliestTime,"-14d")</eval> <eval token="latestTime2">relative_time(latestTime,"-14d")</eval> <eval token="earliestTime3">relative_time(earliestTime,"-21d")</eval> <eval token="latestTime3">relative_time(latestTime,"-21d")</eval> <eval token="earliestTime4">relative_time(earliestTime,"-28d")</eval> <eval token="latestTime4">relative_time(latestTime,"-28d")</eval> </change> </input> <panel> <title>XX</title> <table> <title></title> <search> <query>| multisearch [ search index=XX sourcetype=XX earliest=$earliestTime$ latest=$latestTime$ | eval label="XX" | fields -_raw _time ecn label ] [ search index=XX sourcetype=XX earliest=$earliestTime1$ latest=$latestTime1$ | eval _time=_time+60*60*24*7 | eval label="XX" | fields -_raw _time ecn label ] [ search index=XX sourcetype=XX earliest=$earliestTime2$ latest=$latestTime2$ | eval _time=_time+60*60*24*14 | eval label="XX" | fields -_raw _time ecn label ] [ search index=XX sourcetype=XX earliest=$earliestTime3$ latest=$latestTime3$ | eval _time=_time+60*60*24*21 | eval label="XX" | fields -_raw _time ecn label ] [ search index=XX sourcetype=XX earliest=$earliestTime4$ latest=$latestTime4$ | eval _time=_time+60*60*24*28 | eval label="XX" | fields -_raw _time ecn label] | bin _time span=5m | chart dc(ecn) over _time by label | eval .... | eval .... | eval .... | eval .... | eval .... | fields ... $time_finder.earliest$ $time_finder.latest$ 10 none progressbar false 0 0 0 0 false 0 0 0 0 0 0 false 0 0 0 0 ... View more