Hello,
I did a chart where compare two timeranges. This is my search:
source="tcp:5543" Service_Type="*" earliest=-0d@d latest=now | multikv | eval ReportKey="today" | append [search source="tcp:5543" Service_Type="*" earliest=-1d@d latest=-0d@d| multikv | eval ReportKey="yesterday" | eval _time=_time+86400] | timechart span=5m count(Service_Type) as "Number of Services" by ReportKey
But I have the following messages when I launched it :
[subsearch]: Your timerange was substituted based on your search string
Your timerange was substituted based on your search string
But I don't understand where is the problem.
Thx by advance.