Hi @ITWhisperer  I am still getting the NULL field and its giving me wrong data. I don't see the "Greater than 72Hrs" field. Date  Greater than 12Hrs  Greater than 24Hrs  Greater than 48Hrs  NULL  Total ... View more

Thanks it worked.  ... View more

Yes it does. It is just giving the latest entry for a RQ_ID, rest everything is returned that I need. ... View more

I just have a Splunk timestamp for event logs (which I am considering in latest occurence). But the start time field is in the index and not a Splunk timestamp. The stats command is not working for my start time field. ... View more

START_TS for each of RQ_ID is the start time for each of the request ids which will be different across different ids. I want to find the difference between each of the start time and latest timestamp when the latest logs is getting generated. So basically I want to know how long has the request ids been sitting on the system without getting processed basis different statuses that i have like pending, delivered, error. So the output should be RQ_ID            START_TS                  Diff AS "Time Spent" ... View more

@ITWhisperer I am getting the same message "No results found". ... View more

Worked perfect. Guess I was thinking too far ahead and missed a simple thing. Thanks @gcusello  ... View more

When I put a value in search text input, nothing comes up. ... View more

I am using the tokens in similar way for the other chart elements that use the dropdown. And they seem to work perfectly. The panel say "No results found" when i refresh the page is because there is no id input to begin with as it filters data based on default which ID = null although the other two token conditions are met. How do I have the infomation populated already using the dropdown tokens and then use the text input to filter data.? ... View more

The search query makes sense . I am just little skeptical if the tokens are passed in the right way or not in the query for my purpose. ... View more

Hi, I have only one token to be passed for a particular field. Hence there are no commas required. ... View more

you want to have the results before using the third input, after use, or both ? - after selecting input from dropdowns, once data is populated I want to be able to use search to filter results   do you have "No results found" after the use of the thirtd input or also before (with a default value)? - there is no default value in search as of now . Below is xml for the panel in question   <row depends="$showChart1$"> <panel> <title>Details of the Pending Files - - As per selection</title> <input type="text" token="ID" searchWhenChanged="true"> <label>ID</label> </input> <table> <title>Detailed report </title> <search> <query>base query Date IN($Date$) Template($Template$) ID IN ($ID$) earliest=-2h@m |  dedup SYSID | eval TIME_SPENT=round(((now()-strptime(T1,"%Y-%m-%d %H:%M:%S"))/3600),2)| table field1,field2, field3, TIME_SPENT </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel> </row>     ... View more

Below is the xml for panel in Question. I have used panel specific forms already. <row depends="$showChart1$"> <panel> <title>Details of the Pending Files - - As per selection</title> <input type="text" token="ID" searchWhenChanged="true"> <label>ID</label> </input> <table> <title>Detailed report </title> <search> <query>base query Date IN($Date$) Template($Template$) ID IN ($ID$) earliest=-2h@m |  dedup SYSID | eval TIME_SPENT=round(((now()-strptime(T1,"%Y-%m-%d %H:%M:%S"))/3600),2)| table field1,field2, field3, TIME_SPENT </query> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel> </row> ... View more

Awesome!! Thank you @ITWhisperer for your patience with me. 🙂  ... View more

I got your point on the ISNULL. Sorry I missed that part. But the result is giving me extra columns which i dont want A B C Percentage_A Percentage_B Percentage_C Percentage_Total Total 76 68 2886 2.5082508250825084 2.2442244224422443 95.24752475247524 100 3030   I just want to keep the percentage values  Percentage_A Percentage_B Percentage_C 2.5082508250825084 2.2442244224422443 95.24752475247524 ... View more

Hi @ITWhisperer , thanks for that!! But it is returning 8 rows where i just want below (numbers are hypothetical) A    96.51 B     3.43 C     0.05 ... View more

Hi, your query gives me % total for each field individually on daily basis but can you tell me how to do a % of total for previous 6 days together and not calculate day on day basis. So I just want to return 3 rows for % total of my 3 fields.   Like % A=  A/A+B+C *100 ( for all 6 days together and not by individual dates) ... View more

Thanks @kamlesh_vaghela i got answer for the alignment issue. ... View more

Super! This is working. Is there a way to get the trellis in the middle of the row. It is left aligned at this time. ... View more

Hi @kamlesh_vaghela that's right!! But i wanted to get rid of the count % block with its label. I just want how a normal Single Value trellis would appear. ... View more