Hi - I will try to simplify the naming of the index.
Thanks - and this is excellent by the way! Also, another handy chart would be top sessions by Access Point. Or top amount of sessions by user.
This is usually done by defining a macro that all the searches use. Inside this macro both the index and the sourcetype are specified. This way users can update just the macro to set these 2 values and everything else will work, even after upgrading the app.