I'm creating a saved search using Kibana Discover. On screen I can select the time range manually (default is "Last 15 minutes"). If I select "Last 24 hours" and Refresh the search, it works fine. However, when I save the search, the time range information is not saved. Whenever I open Kibana Discover and open my saved search, the time range is always the default (last 15 minutes).
I tried adding different conditions (below) to my KQL query, to no avail. :^(
and #timestamp >= "now-24h"
and #timestamp >= now-24h
and timestamp >= "now-24h"
and #timestamp >= "now-1d/d"
etc.
I also tried to "Add filter" using the #timestamp field. The only operators available are: is not, is one of, is not one of, is between, is not between, exists, does not exist.
So, I tried between now-24h and now. Yet, no results match the criteria.
However, if I manually change the time range to say, Last 30 days, then my filter works!
Question
How do I include the time range, say last 24 hours, in my KQL saved search so that it overrides the time range that is manually set on screen?
(Motivation: I don't want to change the default manual time range to be larger than the range used in all saved searches. Also, I want to make the saved searches available to a support team with minimal manual configuration.)
(I'm using Kibana v7.10.0.)
Related
Situation is next one:
I created several tiles. Every tile need to show count of records.
Tile "Expired Active Contracts" always shows zero.
There is created simple query with data source table Contract. Ranges are added (ContractStatus; Value: 2) and (ValidTo; Value: (LessThanDate(0)) )
When it's clicked on tile, it opens valid form with valid record, where contracts status is active (2) and ValidTo are any date before today's date, but count doesn't working.
Tried to recreate, tried several things but definitely nothing. ValidTo field is date field.
Some time ago I had a mistake very similar to yours in my dev environment, this steps help me to fix the error.
1 - Clear Usages Data.
2 - SysAdmin/Setup/Data cache/Tile data cache configuration. Select
the tiles which are running into this issue and then delete the
selected tiles.
3- In VS rebuilt and Synchronized the Solution.
4 - Finally refresh the Application browser.
Another thing is that a while ago there was a problem for tiles refresh
Issue 243278 Workspace tile does not update correctly when reusing the
same name
https://fix.lcs.dynamics.com/Issue/Details?bugId=243278&dbType=3&qc=68b6dc6804c9cea218daa102968c7acfcdfe6a990e80e0b5ec66b920a680fceb
I hope you find it useful
I am having a field named rpc in my elasticsearch database and I am displaying it using Kibana. When I search in search bar of kibana like:
rpc:*
It display all the values of rpc field but I want to have only those value to be displayed which are unique.
I have been playing around with Kibana4 since a couple of weeks now. I find it intuitive and simple and the experience has been great till now. Following your question, I tried getting unique results via a Data Table visualization. Why? Because I personally find it easier to understand. Following are the steps:
1. Get unique count
Create the visualization (Visualize -> Data Table). First lets get
the count of how many unique entries we have for a particular field
(We will use this in the later part for verification). I'm using
clientip.raw but as I see, it will work just fine with any friendly
field name too.
2. Set the aggregation right
Set you aggregation back to count and have a Split Rows as follows. Not doing this will give you count 1 for each field value (since it is looking for unique counts) when you populate the table. Noteworthy part is setting the Top field to 0. Because Kibana won't let you enter anything else than a digit (Obviously!). This was the tricky part. Hit Apply and you'll get the results. Unique field values and the count of each of them.
3. Verification:
Going to the last page of the table, we see there are exactly 543 results. This is how I know it works.
What Next?
You save this visualization and add it to a Dashboard. There you can always check the request, query, response and other stats.
Just an addition to the above mathakoot answer.
For the user of newer version (which do not allow bucket size of 0 anymore) just set a value greater than the maximum number of result
And report the value in the Options>Per Page field
I am using Kibana 6 so the UI looks a bit different than the older answers here.
Here is what worked for me
Create a visualization from your query, I used a line graph type (don't think it matters)
Under Data, set metrics aggregation = "Unique Count" and set field to your field.
Set x-axis aggregation = "Terms" and set field to your field.
Set Size > your number of records
Under Metrics and Axes, disable drawing of the graph, circles, and labels (this really helps the UI not lag)
Run query and then click "Inspect" and download CSV
Data
Metrics & Axes
I wanted to achieve something similar but I'm stuck with Kibana 3.1.
I simply added a panel of type "TERMS" and configured its Field = User-agent and left everything else on default values. This gave me a nice bar chart with one bar for each User-agent.
I am new to this forum so I hope I asking my question in the right place.
I have a problem inserting a datetime into a Google Spreadsheet from a form created in Appinventor2;
In app inventor2 I created a form that fills in a google spreadsheet. Basically I merged the Pizza Party example (http://appinventor.mit.edu/explore/ai2/pizzaparty.html) with this example http://puravidaapps.com/spreadsheet.php to use google spreadsheet instead of fusion table.
the user selects in how many minutes he wants his order and then sees all the orders in a table sorted by delivery time.
Problem A)
Firstly, i want to save the current datetime + the desired delay into the google spreadsheet and sort the table by this new datetime.
1) when i use the block "call clock format time" + "call clock addminutes" the spreadsheet is populated with a text, but then i can't sort the table by delivery datetime. in fact i believe the sorting is done on the number regardless of the am/pm or day of the month. so for example instead of having 4am, 6am, 2pm, 3pm i get : 2pm, 3pm, 4am, 6am.
2) I then tried to remove the block "call clock format time" and in the google form i kept the field format = text
but the google spreadsheet is populated with the following:
java.util.GregorianCalendar[time=1395531335908,areFieldsSet=true,lenient=true,zone=Europe/Dublin,firstDayOfWeek=2,minimalDaysInFirstWeek=4,ERA=1,YEAR=2014,MONTH=2,WEEK_OF_YEAR=12,WEEK_OF_MONTH=4,DAY_OF_MONTH=22,DAY_OF_YEAR=81,DAY_OF_WEEK=7,DAY_OF_WEEK_IN_MONTH=4,AM_PM=1,HOUR=11,HOUR_OF_DAY=23,MINUTE=35,SECOND=35,MILLISECOND=908,ZONE_OFFSET=0,DST_OFFSET=0]
3) I then tried to remove the block "call clock format time" and in the google form I changed the field format = time
but then the google spreadsheet isn't populated with anything.
4)I tried using the segment block, but after a while I realised the block "format time" actually returns this format: "hh:mm:ss AM/PM"
so selecting the 5 characters is not good enough because it does not take into account of the am/pm element as well as the day of the month.
5) I found a temp solution by defining the desired delivery time as a new global variable, and extracting a string in the format hh:mm by joining the blocks ".hour instant" and ".minute instant".
However this is not a final solution because what i extracted is of course a string of text and when sorting, 01:10 will be always considered smaller than 23:50 for example, regardless of the date.
So is there a way of actually saving in the google spreadsheet not a string of text, but actually the date and time?
Problem B)
Secondly, I would like to filter/show only the rows of the google spreadsheet have a delivery time expired by no more than 1 hour (as well as orders with delivery time in the future e.g. in 2 hours from now()).
I tried using some Google Visualization API Query Language commands, altering the url of the google spreadsheet (like WHERE "now() - Delivery Time < 60 mins)" (cannot remember the exact code I wrote) but unsucessfully.
Would anyone know how to filter my results?
thanks in advance
alterettore
So there's a few things to note.
If you're using Taifun's example as you mention, you'll notice that when you submit data to Google Spreadsheets using a form, the first column is always a timestamp, even if you're not submitting a date or time. Trying to send the current date/time is redundant - go ahead and make use of what Google provided.
Google Spreadsheets (and Excel) store Date/Time as a number. If you want to store a date in GS, the best way to do so is not formatted text, but by sending a number. Use AppInventor to calculate the number you need. For example, today (April 27) in GS is 41756. Noon today would be 41756.5
To generate this number, start with AI's Millisecond function. NOTE: Both GS and AI use milliseconds, but they have different 0 points, so you have to manipulate the result a bit. The formula I've used in AI in the past is this:
GS Date/Time = (Clock1.GetMillis(Clock1.Now) / 86400000) + 25569
Hope this helps!
I have a problem that I've been going round and round with in Access 2010. Imagine a table with these columns:
Name Date Time
Now, I have a query that asks the user to input a begin date and an end date and returns all records that are between those two dates. This works fine. However, as soon as I add a sort to the Date column things go awry. Once you put a sort on a column with a parameter the user gets asked to enter the parameter twice. From what I've been able to find out this is normal (although annoying) behavior in Access.
If I add the Date column in a second time and show the column with the sort and don't show the column with the parameter it works fine. The query would look something like:
Name Date (shown & sorted) Date (not shown & parameters) Time
Now when I run the query it all works well and comes out the way I want it to. This would obviously be a great solution then. However, there's another problem. When I save the query, leave, and reopen the query the two columns are merged back into each other. Thus, the change is lost and the user again sees two inputs.
My question is this: what can I do differently to achieve the desired results?
Some possible things I've thought about but don't know the answer to are:
Is there a way to make it so the columns don't merge? Do I have to use a form with the input boxes and take the data from that (I'd prefer not to do that as it will require a lot of additional work to handle the various things I am doing in the database). Is there some obvious thing I'm missing?
Thanks for any suggestions.
FYI: Here is the SQL from the query
SELECT Intentions.Intention, Intentions.MassDate, Intentions.[Time Requested], Intentions.[Place Requested], Intentions.[Offered By], Intentions.Completed
FROM Intentions
WHERE (((Intentions.MassDate) Between [Enter start date] And [Enter end date]))
ORDER BY Intentions.MassDate, Intentions.[Time Requested];
It is true that sometimes the Query Designer in Access will "reorganize" a query when you save it. However, I don't recall an instance where such a reorganization actually broke anything.
For what it's worth, the following query seems to do what you desire. After saving and re-opening it looks and behaves just the same:
For reference, the SQL behind it is
PARAMETERS startDate DateTime, endDate DateTime;
SELECT NameDateTime.Name, NameDateTime.Date, NameDateTime.Time
FROM NameDateTime
WHERE (((NameDateTime.Date) Between [startDate] And [endDate]))
ORDER BY NameDateTime.Date DESC , NameDateTime.Time DESC;
I have had the same problem and I have discovered the reason:
If, after you have run your query, sort a collumn in the result grid and the say yes to save changes to the query the sort action will be stored with the query. This will actually cause the query to run twice. First to create the result and then one more time to sort. You'll therefore be asked twice for the parameters.
SOLUTION: Run the query (entering your parameters twice ;-) ). Then remove the Sorting by clicking on the AZ-eraser symbol in the task bar above (in the sorting compartment).
Then open your query in design-mode and add the sorting order to the appropriate collumn.
Your are then good to go.
Regards
Jan
I have a report where it shows meetings and their requirements. However i just want the report to show ONLY today's stuff--not the entire week's worth.
I tried setting my group header (i'm grouping by day) to currentdate but yet it still shows me the entire week. I then have to go to the grouping tree and select today's date. Is there any way to run my report and have it ONLY show today's stuff and nothing else???
Any ideas?
Use the select expert to limit the results to today's date. printdate is a special Crystal Formula keyword.
{table.date_field} = printdate
Or, if you're working with a datetime db field you can strip the time with CDate
CDate({table.date_field}) = printdate
One way would be to change your query so that it's only getting one day's worth of data; that is, assuming your data contains a date field. To take it a step further, you could add date parameters to the query itself and leave the group headers as is. That way, you can have one day of data, or data from a specific date range.
If you have no influence (or desire) to change the way data comes into Crystal Reports, you could also add a formula via the Section Expert to suppress the group or detail section unless the date is the current date.