Hello @yuanliu  What you wrote is similar to my situation.  I solve this problem using different way (Notice that this wasn't the way to go). But your answer made me aware of factors to think about. Thank you for your helping! ... View more

@richgalloway   It work! That 'trace0' show out of condition data like > 20. Thank you for your help! ... View more

@dtburrows3  Thank you for your support! It work! ... View more

@dtburrows3  Thank you for your help. It work! ... View more

Hi! @gcusello  Maybe some requirements are missing from the requirements...I think. I'll try to do that. Thank you for your help! ... View more

Hi @gcusello  Maybe..Yes! I want to use "<viz>" in my code, but I don't know install this in my environment.   Thanks regards ... View more

Hi @gcusello  Yes! That's what I was curious about.  I use this app -> Analysis Of SplunkBase Apps for Splunk | Splunkbase Then Would you like to let me know how can i install the <viz> in my app? When I try to use <viz> in my Splunk app, It shows the error, "Could not add a custom visulization as "display.visualization.custom.type" is missing in ui-prefs.conf.   ... View more

It work!!! Thank you for your help  ... View more

OH..! I get this token at <single> block. The code for this <signle> block looks like this. <single> <title>Max time</title> <search> <query>index=idx_prd_analysis sourcetype="type:prd_analysis:delay_time" corp="delay" | where (plane_type==1) OR (plane_type==2) | eval total_time = round(takeOff_time - boarding_time, 3) | stats MAX(total_time)</query> <earliest>$_time.earliest$</earliest> <latest>$_time.latest$</latest> </search> <option name="colorMode">block</option> <option name="drilldown">all</option> <option name="height">154</option> <option name="numberPrecision">0.000</option> <option name="rangeValues">[500]</option> <option name="refresh.display">progressbar</option> <option name="unitPosition">before</option> <drilldown> <set token="max_value">$click.value$</set> </drilldown> </single>    Are there any solution to send max_value as normal format not origin? (Not 123,456 -> Wnat 123456) ... View more

Thank you for you help! It work!! ... View more

This is my code about the drop down <input type="dropdown" token="start_time" searchWhenChanged="true"> <label>First IR init Time (sec)</label> <fieldForLabel>start_time</fieldForLabel> <fieldForValue>start_time</fieldForValue> <search> <query>index=idx_ptd_dataset sourcetype="type:ptd_dataset:data" corp="flight" | where !isnull(location) | where !isnull(landing_time) | eval st_time= round(landing_time,0) | where st_time &lt;=90 | stats values by st_time | sort st_time</query> </search> <default>ALL</default> <choice value="ALL">ALL</choice> </input>       ... View more

I never thought of it this way. Thank you for your information!! ... View more

But it cound not recognized " like(day_type, "%day")" It said the expression is malformed.😢 ... View more

OHHH There is something wrong my code. It work! Thank you for your help!!!😀 ... View more

I added this code under my code, but it show three rows 😢 row 1, "metal", "dt" How could I solve this? I added this line <search> <query> ... |sort total_time |transpose |eval dt = case("$value$" == "iron", "metal", 1=1, "food") |eval {dt}='row 1' ... </query> </search> <option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option> ... View more

<row>     <panel>       <chart>         <title>checking the making time</title>         <search>           <query>   | where make_end_time &lt;= 50   | where amount != "None"               | where total_time &lt;= 15               | where value_type = case("$v_type$"=="iron", 1, "$v_type$"=="steak", 2, 1=1, value_type)               | eval get_start_time = prepare - welcome               | eval wash_time = finish_wash - prepare               | eval make = make_time - finish_wash               | chart eval(round(avg(get_start_time), 3)) as "Start time" eval(round(avg(wash_time), 3)) as "cleaning" eval(round(avg(coook), 3)) as "making"               | sort total_time               |transpose                |rename "row 1" as "metal" |rename "row 2" as "food"</query>         </search>         <option name="charting.fieldColors">{"metal": 0xffffff, "food" : 0xFF0000}</option> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisMiddle</option>         <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>         <option name="charting.axisTitleX.visibility">visible</option>         <option name="charting.axisTitleY.text">time(s)</option>         <option name="charting.axisTitleY.visibility">visible</option>         <option name="charting.axisTitleY2.visibility">visible</option>         <option name="charting.axisY.abbreviation">none</option>         <option name="charting.axisY.scale">linear</option>         <option name="charting.axisY2.enabled">0</option>         <option name="charting.axisY2.scale">inherit</option>         <option name="charting.chart">line</option>         <option name="charting.chart.stackMode">default</option>         <option name="charting.drilldown">all</option>         <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>         <option name="charting.legend.mode">standard</option>         <option name="charting.legend.placement">top</option>         <option name="height">363</option>         <option name="refresh.display">progressbar</option>         <option name="trellis.enabled">0</option>       </chart>     </panel>   </row> This is my origin code! The data will send to the server ... View more