Please try not to keep editing and deleting messages, as I just lost my reply as a result. So here again... Try this source=abc type=Changed event_id="*" (msg="consumed event" OR (msg=" finished processing" AND duration>1) ``` Rename consumed customer Id ``` | rename event.data{}.id as id ``` Join start/finish events together for the event_id | stats count values(duration) as duration values(id) as id by event_id ``` and filter only for customer ``` | where id="XYZ" AND count=2 ``` Get the average ``` | stats avg(duration) as duration This assumes there is more than one sequence per customer. Will one customer have more than one pair of events for each event id? This counts the events to make sure that there are two events per event_id and then filters for your customer and then gets the average of all events    

This example will calculate those ranks from the base data of Student+Score, which uses eventstats to build the collection of scores (stats list) and then mvfind to find the position in the list and then calculate rank. | makeresults count=10 | fields - _time | streamstats c as Score | eval Student="Student ".(11 - Score) | table Student Score ``` Above simulates your data ``` ``` Generate list of scores and find position in results ``` | sort Score | eventstats count list(Score) as Scores | eval pos=mvfind(Scores, "^".Score."$") ``` Now calculate ranks ``` | eval Rank_Inc=round(pos/(count-1)*100, 0) | eval Rank_Exc=round((pos+1)/(count+1)*100, 0) | fields - Scores pos count The bit from sort score is what you want 

That sort of functionality is quite involved. The descriptions below are for Simple XML  https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML https://docs.splunk.com/Documentation/Splunk/9.1.1/Viz/tokens https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect In your dashboard you will need something like <drilldown> <set token="clicked_url">$row.URL$</set> <set token="run_collect"></set> </drilldown> You will need a global search that does the collect, e.g. something like this will create a new row with your user/URL and collect that to your index. This search is dependent on the run_collect token being set, so will only happen when the user clicks the row. It will unset the token at the end, so it can run again. <search depends="$run_collect$"> <query> | makeresults | eval user=$env:user|s$ | eval URL=$clicked_url|s$ | collect index=your_index </query> <done> <unset token="run_collect"> </done> </search> As to hiding the data on the dashboard, is this to be hidden forever or just in this version of the dashboard? Much will depend on that. You don't actually need to collect it to an index, you could write this information to a CSV lookup, which may be a better option if you want to hide this information all the time once clicked. In that case you could use that as a lookup to filter previous clicked information. Anyway, this is a fairly complex use case for a dashboard - it's certainly all possible, but this is a bit more involved for a basic dashboard. This is NOT applicable to dashboard studio - you mention both in your question tags. In principle the approach could be the same, but the technical implementation is not as above.