hello
I call a timechart from a loadjob command like below and it works
| loadjob savedsearch="admin:toto_sh:win timechart2"
But I need to filter the events of my timechart by host because I use a text entry in my dashboard
Do I have to put the timechart count after the loadjob command like below or something else?
| loadjob savedsearch="admin:TOTO_sh:winevent timechart2"
| search host=$tok_filterhost$
| timechart count by sourcetype limit=10 useother=false
thanks for your help
↧