I was able to use the appendpipe from the link @thambisetty provided to get what I need. Thank you!  | appendpipe [|stats count | addinfo | eval temp=info_min_time."##".info_max_time | makemv temp delim="##" | mvexpand temp | eval count=0 | eval _time=temp | table _time count] | fillnull value=100 | timechart span=1d values(Score) as Score by business_service | makecontinuous | fillnull value=100 ... View more

Thank you @thambisetty for your reply.  I made a few modification to a field I found a in the inputlookup called "opened" and performed and | eval _time to make it work with timechart.  However,  the timechart ends on May instead of the current month of Oct.   How do I get the timechart to start from the begining of the year to now. Added the following: | eval _time = strptime(opened, "%Y-%m-%d") | timechart span=1d list(Score) as Score by business_service | makecontinuous | fillnull value=100 Full Query with change.  I attached a screenshot of what it looks like.: | inputlookup "Something.csv" | eval _time = strptime(opened, "%Y-%m-%d") | search business_service IN('"foo"') | stats sum(imp_duration) as YTD_Impact_Hours values(inc_no) as inc_no by business_service _time | eval YTD_Hours=6600 | eval Score=round(((1-(YTD_Impact_Hours / YTD_Hours))*100),3) | timechart span=1d list(Score) as Score by business_service | makecontinuous | fillnull value=100 | eval expected_score=100 | rename business_service as "Business Service" YTD_Impact_Hours as "Impact Hours" the_month as Date inc_no as Incident Score as "Actual Score" | fields - "Impact Hours" Incident ... View more

This works beautifully! Thank you so much @to4kawa!! ... View more

Hi @to4kawa. Thank you. Sorry, I'm not explaining myself clearly. This query is part of a dashboard panel that relies on user inputs from a drop down menu with three choices. Either "2019" , "2020" or both with choice "Rolling 2019-2020". The token used for the drop down menu input is $date$. If the user selects the "Rolling 2019-2020" choice, then the token $date$ will be "2019-Present". Based on the choice of the user as seen in the XML listed below, I need to do an eval, if "2019-Present" is the value of $date$ then date_tok will return, in this exact format, the value of '"/2019","/2020"' . I get no results from this. I'm having trouble passing through '"/2019","/2020"' to the |search OpenedOn IN(date_tok) to filter the results. ====================================================================================== Here is the xml of the input Date input: <input type="dropdown" token="date" searchWhenChanged="true"> <label>Year</label> <choice value="2019-Present">Rolling 2019-2020</choice> <choice value="2019">2019</choice> <choice value="2020">2020</choice> </input> ===================================================================================== Dashboard Panel query ...base search | eval date=$date$ | eval date_tok=case(date=2019-Present,'"/2019","/2020"' ,date=2019,"/2019" ,date=2020,"/2020") | eval OpenedOn=date_tok | search "Change Type" IN("$form.changerequesttype$") OpenedOn IN(date_tok) | bin span=1mon OpenedOn | chart count(sys_id) as count over OpenedOn_2 by "Business Service" limit=0 | addtotals ====================================================================================== Thank you. ... View more

Thank you for your quick response. I tried this query and it doesn't work. My issue is I need OpenedOn to equal "/2019" and "/2020" in this format ' "/2019","/2020" ' then use | search OpenedOn IN(dtok) to filter the results for all values that were created in 2019 and 2020. ...base search | eval date=2019 | eval dtok=case(date="2019-Present", "(/2019|/2020)", date="2019", "/2019", date="2020", "/2020") | where match(OpenedOn, dtok) | bin span=1mon OpenedOn | chart count(sys_id) as count over OpenedOn_2 by "Business Service" limit=0 | addtotals ... View more