Hi, Say I have the following table: Name  2022-06-07 10:01:14 2022-06-07 22:01:13 2022-06-08 10:01:11 2022-06-08 22:01:25 2022-06-09 10:01:22 2022-06-09 22:00:59 2022-06-10 10:01:28 a 301 300 302 303 301 400 412 b 200 220 235 238 208 300 302 Can I color a cell based on the increment rate from the previous value? for instance- if the value increased by 10%, it will be yellow, 20% would be Orange and so on.  I'm looking for a solution based on simple xml where no additional files are needed. Thanks. ... View more

Hi, Say I have this table: Name Date Flows a 2022-06-13 23:01:26 200 a 2022-06-13 10:01:26 301 b 2022-06-13 23:01:26 504 b 2022-06-13 10:01:26 454   I'd like to create a table that's using the values of "Date" column as a new columns, and grouping all the identical "Name" values into one line as follows (where the values are "Flows"): Name 2022-06-13 23:01:26 2022-06-13 10:01:26 a 200 301 b 504 454   I tried several approaches but failed. Could you assist? ... View more

Hi, I have the field Queue in my dataset with pattern as follows: adcams01 adcams02 adcems05 I would like to create a new column in my table which contains 3 letters after adc. For example: Queue: Site adcams01 ams adcams02 ams adcems05 ems Is it possible using regex? I know it should include eval but it didn't work for me. Thank you ... View more

Hi, I've been trying for hours and nothing works, so I figure you might help me out. I have the following very long query:       | tstats SUM(requested_cpus) as requested_cpus, SUM(reserved_ram) as reserved_ram, SUM(requested_ram) as requested_ram, SUM(used_ram) as used_ram, SUM(compute_ram_total) as compute_ram_total, count as agg_field_seen WHERE (index=monitor (host="$queuename$") fs_group=$fsgroup$ project=$project$ site=$site$ (slave_resource{} IN ("*")) (NOT slave_resource{} IN ("___VALUE_NONE___")) ( host_state="normal" OR host_state="full" OR host_state="ovrld" OR host_state="sick" OR host_state="susp" OR host_state="base" OR host_state="ready") ) OR (index=ncstat_monitor (host="$queuename$") fs_group=$fsgroup$ project=$project$ site=$site$ (compute_slave_res{} IN ("*")) (NOT compute_slave_res{} IN ("___VALUE_NONE___")) ( host_state="normal" OR host_state="full" OR host_state="ovrld" OR host_state="sick" OR host_state="susp" OR host_state="base" OR host_state="ready") ) BY _time, site, fs_group span=15min | eval query_enabled=1 | eventstats sum(agg_field_seen) AS sum_agg_field_seen BY fs_group | sort 0 - sum_agg_field_seen | streamstats dc(fs_group) AS rank | eval agg_field_ranked=if(rank <= 50 - 1, 'fs_group', "Other") | rename agg_field_ranked as fs_group | stats SUM(reserved_ram) as reserved_ram, SUM(requested_ram) as requested_ram, SUM(used_ram) as used_ram, SUM(compute_ram_total) as compute_ram_total, SUM(requested_cpus) as requested_cpus BY _time, site, fs_group | eval slots=max(reserved_ram/32,requested_cpus) | eval full_fsgroup=site.":".fs_group | timechart span=15min limit=50 partial=false MAX(slots) as Slots BY full_fsgroup       In addition, I have another query from different index:       `p_flow("*",dv)` "***" reg_name=*$reg$* event_type=flow | eval fairshare = coalesce(fairshare, fsgroup) | table fairshare | dedup fairshare        The issue is, I would like to limit the results to match only the output of the fairshare field from the second query. Please notice that fairshare in the first query called fs_group I've been trying many options from different past answers and nothing seem to be working. Please assist and be blessed forever. ... View more

Hi, I have data with the following attributes: class, user, id, value. I want to execute for value larger than <number> and for the top 5 classes with the maximal quantity of records (ids), the user with maximum records for each of those classes. I have this for now (which gives me the first part) :  index="x"  value>1036800 | fields class id value | chart count(id) as 12+_days by class  | sort -12+_days limit=5 example for my expected final results: user 12+_days user_a 215 user_b 35 user_c 65 user_d 656 user_e 695 where each of those users is from different class from the top 5 classes. I tried nested loop with square brackets but nothing gave my the expected result. Thanks. ... View more

Hi, I want to present the following table: class: 5-12 min 12-24 min 24+ min classA 12 20 40 classB 42 56 54 classC 15 57 14   i.e For each class, I want to count all the records (id) that fall into each bucket. This is what I have now: index="x" queuename=vncisr runtime>300 | fields class id runtime | eval runtime = case(runtime < 720, "5-12 min", runtime < 1440 , "12-24 min", 1==1, "24+ min") | chart count by runtime And I only get the total count for each bucket without considering the classes. I hope it was clear.   ... View more