https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard/m-p/533081#M36299 <P>Hello,</P> <P>Working on a Splunk Dashboard to pull specific data in return and when exporting to an Excel sheet, it provides the needed data. A breakdown of Per user, per department, avg memory usage per week of the end-users. So when you Export the data to Excel, the information isn’t clean and doesn’t bring down everything, a better break down of Per User, Per Department and taking the avg of that user/machine for a week</P> <P>Here is the code source so far:</P> <P>&nbsp;</P> <LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;End User Computing - Desktop Dashboard Clone HJ&lt;/label&gt; &lt;fieldset submitButton="false" autoRun="false"&gt; &lt;input type="dropdown" token="hosttok" searchWhenChanged="true"&gt; &lt;label&gt;Host Selector&lt;/label&gt; &lt;search&gt; &lt;query&gt;| metadata type=hosts index=perfmon sourcetype="Perfmon:Process" |table host Department |sort host&lt;/query&gt; &lt;earliest&gt;-24@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;fieldForLabel&gt;host&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;host&lt;/fieldForValue&gt; &lt;prefix&gt;"&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;/input&gt; &lt;input type="time" token="TimerangePicker" searchWhenChanged="true"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-4h@m&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Computer Information -Click "HostName" to launch LANDesk remote control via browser&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;index=prd_win_domain_reports earliest=-24h sourcetype=DNS_Records_Info HostName="*" |eval DeviceName=HostName |join type=left DeviceName [search index=prd_dbx_ld_compsys sourcetype="dbmon:kv" earliest=-24h DeviceName="*" |replace "saccap.int/Workstations/*" with "*" in ComputerLocation |replace "CN=*" with "*" in PrimaryOwner |replace "*,OU=Accounts,DC=saccap,DC=int" with "*" in PrimaryOwner |rename ComputerLocation as OU |eval LastUpdate=strftime(_time, "%Y-%m-%d %I:%M:%p")] |rename DeviceName as host |join type=left host [search index=* sourcetype="WMI:MemoryInfo" earliest=-24h host="*" |dedup host DeviceLocator |eval DIMM_GB=((Capacity/1024)/1024/1024) |eventstats sum(DIMM_GB) AS Total by host |dedup host |eval Total=round(Total)." GB" |fillnull value="-" |eval DIMM_GB=if(DIMM_GB="-","-",DIMM_GB." GB") |transaction mvlist=true host |rename Total as Memory | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p")] |join type=left host [search index=* sourcetype=WMI:ProcessorInfo earliest=-24h host="*" |eval hostsCPU=host.DeviceID |dedup hostsCPU |rename NumberOfCores as Cores |rename MaxClockSpeed as ClockSpeed |rename Name as Processor] |join type=left host [search index=* sourcetype=WMI:Version earliest=-24h host="*" |dedup host |eval LastBootUpTime=replace(LastBootUpTime, "^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(.*)", "\2-\3-\1 \4:\5:\6") |rename Caption as OperatingSystem |rename LastBootUpTime as LastReboot] |join type=left host [search index=* sourcetype="WMI:ComputerSystem" earliest=-24h host="*"] |search host=$hosttok$ |table HostName LoginName PrimaryOwner OU IPAddress Model SerialNum ClockSpeed Cores Processor Memory ADAPTERSTRING MEMORY OperatingSystem Version LastReboot LastUpdInvSvr VALastScanDate&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;1&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;cell&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;false&lt;/option&gt; &lt;drilldown&gt; &lt;link target="_blank"&gt;https://$click.value$:4343/index.html&lt;/link&gt; &lt;/drilldown&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;LANDesk Events&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;index=ivanti_EPM Changed_by="**" Type_of_Change="*" Message="***" | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p") |rename Changed_on_machine as host |search host=$hosttok$ | table Date Time Changed_by host Type_of_Change Item_name |sort Date, Time&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;true&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;CPU Usage&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index="perfmon" host=$hosttok$ object=Processor counter="% Processor Time" instance=_Total | timechart bins=1000 minspan=1m avg(Value) as "% Processor Time _Total Avg per Min" by Host&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;refresh&gt;2m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;collapsed&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="height"&gt;249&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;Application Alerts&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index=prd_win_wrk_app host=* (EventCode=1002 OR EventCode=1000) |eval Date=strftime(_time, "%Y-%m-%d") |eval Time=strftime(_time, "%I:%M:%p") |eval Faulting_application_path=lower(Faulting_application_path) |replace "c:\users\*\phprod.exe" with "PHPROD" in Faulting_application_path |replace "c:\program files*\outlook.exe" with "Outlook" in Faulting_application_path |replace "c:\program files*\winword.exe" with "Word" in Faulting_application_path |replace "c:\program files*\excel.exe" with "Excel" in Faulting_application_path |replace "c:\program files*\symphony.exe" with "Symphony" in Faulting_application_path |replace "c:\firmapps*\dashboard.exe" with "Ops Dashboard" in Faulting_application_path |replace "c:\program files (x86)*\ssms.exe" with "SQL Management Studio" in Faulting_application_path |replace "c:\program files*\ciscojabber.exe" with "Jabber" in Faulting_application_path |replace "c:\blp*" with "Bloomberg" in Faulting_application_path |replace "c:\*neovest.exe" with "Neovest" in Faulting_application_path |replace "c:\users*\ciscocollabhost.exe" with "Cisco Spark" in Faulting_application_path |fillnull NA |eval Application_Path=lower(Application_Path) |replace "c:\users\*\phprod.exe" with "PHPROD" in Application_Path |replace "c:\program files*\outlook.exe" with "Outlook" in Application_Path |replace "c:\program files*\winword.exe" with "Word" in Application_Path |replace "c:\program files*\excel.exe" with "Excel" in Application_Path |replace "c:\program files*\symphony.exe" with "Symphony" in Application_Path |replace "c:\firmapps*\dashboard.exe" with "Ops Dashboard" in Application_Path |replace "c:\program files (x86)*\ssms.exe" with "SQL Management Studio" in Application_Path |replace "c:\program files*\ciscojabber.exe" with "Jabber" in Application_Path |replace "c:\blp*" with "Bloomberg" in Application_Path |replace "c:\*neovest.exe" with "Neovest" in Application_Path |replace "c:\users*\ciscocollabhost.exe" with "Cisco Spark" in Application_Path |fillnull NA |search Application_Path=Excel OR Faulting_application_path=Excel OR Application_Path=Outlook OR Faulting_application_path=Outlook OR Application_Path=Word OR Faulting_application_path=Word OR Application_Path=Bloomberg OR Faulting_application_path=Bloomberg OR Application_Path="Ops Dashboard" OR Faulting_application_path="Ops Dashboard" OR Application_Path=Neovest OR Faulting_application_path=Neovest |sort _time, limit=0 | where isnotnull(user) | fillnull NA | fields * | stats count(Faulting_application_path) AS count BY Faulting_application_path | sort Faulting_application_path&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;refresh&gt;5m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;collapsed&lt;/option&gt; &lt;option name="charting.axisTitleY.text"&gt;Count&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;pie&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;all&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;1&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; &lt;drilldown&gt; &lt;link target="_blank"&gt;https://support.office.com/en-us/article/fixes-or-workarounds-for-recent-issues-in-outlook-for-windows-ecf61305-f84f-4e13-bb73-95a214ac1230?ui=en-US&amp;amp;rs=en-US&amp;amp;ad=US&lt;/link&gt; &lt;/drilldown&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;Memory Usage&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index="perfmon" host=$hosttok$ object=Memory counter="Available MBytes" instance=*| timechart bins=1000 minspan=1m avg(Value) as "Available MBytes Avg per Min" By Host&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;refresh&gt;2m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;connect&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;User Login Information - Last 7 days&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;sourcetype=WinEventLog:Security (EventCode=4624 (Logon_Type=2 OR Logon_Type=10 OR Logon_Type=7)) OR EventCode=4801 OR EventCode=4803 AND dest_nt_domain=SACCAP host=$hosttok$ | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p") | sort _time limit=0 | dedup Date, user | lookup AD_Account_Info.csv LogonName as Account_Name OUTPUT Name, Department, Office, FirstName, LastName | replace "*.saccap.int" with "*" in ComputerName | replace "*.saccap.int" with "*" in dest_nt_host | eval Source=dest_nt_domain | eval Country=Office | table Date Time ComputerName user FirstName LastName Department Office | sort -Date limit=0&lt;/query&gt; &lt;earliest&gt;-7d@h&lt;/earliest&gt; </LI-CODE> <P>Thank you!</P> Tue, 15 Dec 2020 15:36:52 GMT hj7654 2020-12-15T15:36:52Z https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard/m-p/533081#M36299 <P>Hello,</P> <P>Working on a Splunk Dashboard to pull specific data in return and when exporting to an Excel sheet, it provides the needed data. A breakdown of Per user, per department, avg memory usage per week of the end-users. So when you Export the data to Excel, the information isn’t clean and doesn’t bring down everything, a better break down of Per User, Per Department and taking the avg of that user/machine for a week</P> <P>Here is the code source so far:</P> <P>&nbsp;</P> <LI-CODE lang="markup">&lt;form&gt; &lt;label&gt;End User Computing - Desktop Dashboard Clone HJ&lt;/label&gt; &lt;fieldset submitButton="false" autoRun="false"&gt; &lt;input type="dropdown" token="hosttok" searchWhenChanged="true"&gt; &lt;label&gt;Host Selector&lt;/label&gt; &lt;search&gt; &lt;query&gt;| metadata type=hosts index=perfmon sourcetype="Perfmon:Process" |table host Department |sort host&lt;/query&gt; &lt;earliest&gt;-24@h&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/search&gt; &lt;fieldForLabel&gt;host&lt;/fieldForLabel&gt; &lt;fieldForValue&gt;host&lt;/fieldForValue&gt; &lt;prefix&gt;"&lt;/prefix&gt; &lt;suffix&gt;"&lt;/suffix&gt; &lt;choice value="*"&gt;All&lt;/choice&gt; &lt;/input&gt; &lt;input type="time" token="TimerangePicker" searchWhenChanged="true"&gt; &lt;label&gt;&lt;/label&gt; &lt;default&gt; &lt;earliest&gt;-4h@m&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;/default&gt; &lt;/input&gt; &lt;/fieldset&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;Computer Information -Click "HostName" to launch LANDesk remote control via browser&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;index=prd_win_domain_reports earliest=-24h sourcetype=DNS_Records_Info HostName="*" |eval DeviceName=HostName |join type=left DeviceName [search index=prd_dbx_ld_compsys sourcetype="dbmon:kv" earliest=-24h DeviceName="*" |replace "saccap.int/Workstations/*" with "*" in ComputerLocation |replace "CN=*" with "*" in PrimaryOwner |replace "*,OU=Accounts,DC=saccap,DC=int" with "*" in PrimaryOwner |rename ComputerLocation as OU |eval LastUpdate=strftime(_time, "%Y-%m-%d %I:%M:%p")] |rename DeviceName as host |join type=left host [search index=* sourcetype="WMI:MemoryInfo" earliest=-24h host="*" |dedup host DeviceLocator |eval DIMM_GB=((Capacity/1024)/1024/1024) |eventstats sum(DIMM_GB) AS Total by host |dedup host |eval Total=round(Total)." GB" |fillnull value="-" |eval DIMM_GB=if(DIMM_GB="-","-",DIMM_GB." GB") |transaction mvlist=true host |rename Total as Memory | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p")] |join type=left host [search index=* sourcetype=WMI:ProcessorInfo earliest=-24h host="*" |eval hostsCPU=host.DeviceID |dedup hostsCPU |rename NumberOfCores as Cores |rename MaxClockSpeed as ClockSpeed |rename Name as Processor] |join type=left host [search index=* sourcetype=WMI:Version earliest=-24h host="*" |dedup host |eval LastBootUpTime=replace(LastBootUpTime, "^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(.*)", "\2-\3-\1 \4:\5:\6") |rename Caption as OperatingSystem |rename LastBootUpTime as LastReboot] |join type=left host [search index=* sourcetype="WMI:ComputerSystem" earliest=-24h host="*"] |search host=$hosttok$ |table HostName LoginName PrimaryOwner OU IPAddress Model SerialNum ClockSpeed Cores Processor Memory ADAPTERSTRING MEMORY OperatingSystem Version LastReboot LastUpdInvSvr VALastScanDate&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;1&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;cell&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;false&lt;/option&gt; &lt;drilldown&gt; &lt;link target="_blank"&gt;https://$click.value$:4343/index.html&lt;/link&gt; &lt;/drilldown&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;LANDesk Events&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;index=ivanti_EPM Changed_by="**" Type_of_Change="*" Message="***" | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p") |rename Changed_on_machine as host |search host=$hosttok$ | table Date Time Changed_by host Type_of_Change Item_name |sort Date, Time&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;/search&gt; &lt;option name="count"&gt;20&lt;/option&gt; &lt;option name="dataOverlayMode"&gt;none&lt;/option&gt; &lt;option name="drilldown"&gt;none&lt;/option&gt; &lt;option name="percentagesRow"&gt;false&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="rowNumbers"&gt;false&lt;/option&gt; &lt;option name="totalsRow"&gt;false&lt;/option&gt; &lt;option name="wrap"&gt;true&lt;/option&gt; &lt;/table&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;CPU Usage&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index="perfmon" host=$hosttok$ object=Processor counter="% Processor Time" instance=_Total | timechart bins=1000 minspan=1m avg(Value) as "% Processor Time _Total Avg per Min" by Host&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;refresh&gt;2m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;collapsed&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="height"&gt;249&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;Application Alerts&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index=prd_win_wrk_app host=* (EventCode=1002 OR EventCode=1000) |eval Date=strftime(_time, "%Y-%m-%d") |eval Time=strftime(_time, "%I:%M:%p") |eval Faulting_application_path=lower(Faulting_application_path) |replace "c:\users\*\phprod.exe" with "PHPROD" in Faulting_application_path |replace "c:\program files*\outlook.exe" with "Outlook" in Faulting_application_path |replace "c:\program files*\winword.exe" with "Word" in Faulting_application_path |replace "c:\program files*\excel.exe" with "Excel" in Faulting_application_path |replace "c:\program files*\symphony.exe" with "Symphony" in Faulting_application_path |replace "c:\firmapps*\dashboard.exe" with "Ops Dashboard" in Faulting_application_path |replace "c:\program files (x86)*\ssms.exe" with "SQL Management Studio" in Faulting_application_path |replace "c:\program files*\ciscojabber.exe" with "Jabber" in Faulting_application_path |replace "c:\blp*" with "Bloomberg" in Faulting_application_path |replace "c:\*neovest.exe" with "Neovest" in Faulting_application_path |replace "c:\users*\ciscocollabhost.exe" with "Cisco Spark" in Faulting_application_path |fillnull NA |eval Application_Path=lower(Application_Path) |replace "c:\users\*\phprod.exe" with "PHPROD" in Application_Path |replace "c:\program files*\outlook.exe" with "Outlook" in Application_Path |replace "c:\program files*\winword.exe" with "Word" in Application_Path |replace "c:\program files*\excel.exe" with "Excel" in Application_Path |replace "c:\program files*\symphony.exe" with "Symphony" in Application_Path |replace "c:\firmapps*\dashboard.exe" with "Ops Dashboard" in Application_Path |replace "c:\program files (x86)*\ssms.exe" with "SQL Management Studio" in Application_Path |replace "c:\program files*\ciscojabber.exe" with "Jabber" in Application_Path |replace "c:\blp*" with "Bloomberg" in Application_Path |replace "c:\*neovest.exe" with "Neovest" in Application_Path |replace "c:\users*\ciscocollabhost.exe" with "Cisco Spark" in Application_Path |fillnull NA |search Application_Path=Excel OR Faulting_application_path=Excel OR Application_Path=Outlook OR Faulting_application_path=Outlook OR Application_Path=Word OR Faulting_application_path=Word OR Application_Path=Bloomberg OR Faulting_application_path=Bloomberg OR Application_Path="Ops Dashboard" OR Faulting_application_path="Ops Dashboard" OR Application_Path=Neovest OR Faulting_application_path=Neovest |sort _time, limit=0 | where isnotnull(user) | fillnull NA | fields * | stats count(Faulting_application_path) AS count BY Faulting_application_path | sort Faulting_application_path&lt;/query&gt; &lt;earliest&gt;@d&lt;/earliest&gt; &lt;latest&gt;now&lt;/latest&gt; &lt;sampleRatio&gt;1&lt;/sampleRatio&gt; &lt;refresh&gt;5m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;collapsed&lt;/option&gt; &lt;option name="charting.axisTitleY.text"&gt;Count&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.abbreviation"&gt;none&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;pie&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;gaps&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;all&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;stacked&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;1&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.mode"&gt;standard&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="charting.lineWidth"&gt;2&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;option name="trellis.enabled"&gt;0&lt;/option&gt; &lt;option name="trellis.scales.shared"&gt;1&lt;/option&gt; &lt;option name="trellis.size"&gt;medium&lt;/option&gt; &lt;drilldown&gt; &lt;link target="_blank"&gt;https://support.office.com/en-us/article/fixes-or-workarounds-for-recent-issues-in-outlook-for-windows-ecf61305-f84f-4e13-bb73-95a214ac1230?ui=en-US&amp;amp;rs=en-US&amp;amp;ad=US&lt;/link&gt; &lt;/drilldown&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;panel&gt; &lt;title&gt;Memory Usage&lt;/title&gt; &lt;chart&gt; &lt;search&gt; &lt;query&gt;index="perfmon" host=$hosttok$ object=Memory counter="Available MBytes" instance=*| timechart bins=1000 minspan=1m avg(Value) as "Available MBytes Avg per Min" By Host&lt;/query&gt; &lt;earliest&gt;$TimerangePicker.earliest$&lt;/earliest&gt; &lt;latest&gt;$TimerangePicker.latest$&lt;/latest&gt; &lt;refresh&gt;2m&lt;/refresh&gt; &lt;refreshType&gt;delay&lt;/refreshType&gt; &lt;/search&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.overflowMode"&gt;ellipsisNone&lt;/option&gt; &lt;option name="charting.axisLabelsX.majorLabelStyle.rotation"&gt;0&lt;/option&gt; &lt;option name="charting.axisTitleX.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisTitleY2.visibility"&gt;visible&lt;/option&gt; &lt;option name="charting.axisX.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY.scale"&gt;linear&lt;/option&gt; &lt;option name="charting.axisY2.enabled"&gt;0&lt;/option&gt; &lt;option name="charting.axisY2.scale"&gt;inherit&lt;/option&gt; &lt;option name="charting.chart"&gt;line&lt;/option&gt; &lt;option name="charting.chart.bubbleMaximumSize"&gt;50&lt;/option&gt; &lt;option name="charting.chart.bubbleMinimumSize"&gt;10&lt;/option&gt; &lt;option name="charting.chart.bubbleSizeBy"&gt;area&lt;/option&gt; &lt;option name="charting.chart.nullValueMode"&gt;connect&lt;/option&gt; &lt;option name="charting.chart.showDataLabels"&gt;none&lt;/option&gt; &lt;option name="charting.chart.sliceCollapsingThreshold"&gt;0.01&lt;/option&gt; &lt;option name="charting.chart.stackMode"&gt;default&lt;/option&gt; &lt;option name="charting.chart.style"&gt;shiny&lt;/option&gt; &lt;option name="charting.drilldown"&gt;all&lt;/option&gt; &lt;option name="charting.layout.splitSeries"&gt;0&lt;/option&gt; &lt;option name="charting.layout.splitSeries.allowIndependentYRanges"&gt;0&lt;/option&gt; &lt;option name="charting.legend.labelStyle.overflowMode"&gt;ellipsisMiddle&lt;/option&gt; &lt;option name="charting.legend.placement"&gt;right&lt;/option&gt; &lt;option name="refresh.display"&gt;progressbar&lt;/option&gt; &lt;/chart&gt; &lt;/panel&gt; &lt;/row&gt; &lt;row&gt; &lt;panel&gt; &lt;title&gt;User Login Information - Last 7 days&lt;/title&gt; &lt;table&gt; &lt;search&gt; &lt;query&gt;sourcetype=WinEventLog:Security (EventCode=4624 (Logon_Type=2 OR Logon_Type=10 OR Logon_Type=7)) OR EventCode=4801 OR EventCode=4803 AND dest_nt_domain=SACCAP host=$hosttok$ | eval Date=strftime(_time, "%Y-%m-%d") | eval Time=strftime(_time, "%I:%M:%S:%p") | sort _time limit=0 | dedup Date, user | lookup AD_Account_Info.csv LogonName as Account_Name OUTPUT Name, Department, Office, FirstName, LastName | replace "*.saccap.int" with "*" in ComputerName | replace "*.saccap.int" with "*" in dest_nt_host | eval Source=dest_nt_domain | eval Country=Office | table Date Time ComputerName user FirstName LastName Department Office | sort -Date limit=0&lt;/query&gt; &lt;earliest&gt;-7d@h&lt;/earliest&gt; </LI-CODE> <P>Thank you!</P> Tue, 15 Dec 2020 15:36:52 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Dashboard/m-p/533081#M36299 hj7654 2020-12-15T15:36:52Z