Hi splunkman341, This is possible! try with this query: sourcetype=doccloud_catalina "Document workspace" earliest=-7d | rex "(?<action>created|updated|deleted\/moved) (?:.*) OOID:(?<OOID>[^,]+)" | chart count by OOID action | addtotals | sort 5 -Total ... View more

HI, Try with this! This query display all count by minute! sourcetype = access_combined | stats count as requests_per_minute by _time | where requests_per_minute <=10 | timechart span=1m count as downtime_duration Or try with This query display all count (also 0) by minute, but the lines that contain count Not equal 0 are display with value = 1 sourcetype = access_combined | bucket span=1m _time | stats count as requests_per_minute by _time | where requests_per_minute <=10 | timechart span=1m count as downtime_duration ... View more

Hi mrfredman, This is not possible because, Splunk identifies rows as major breaks , so you can't expand a panel across two or more than three rows. ... View more

Hi metersk, Try with appendcols command like this : `Your primary search' | join [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg |appendcols [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] ... View more

Hi jeffreyjewitt, This is possible with a single dashboard! Edit your panels of your dashboard and add an Time input type with option Add input like follow example: This is a xml code of dashboard form where Time range is configured, with this, you can select a time to run you Scheduled searh. <form> <label>Form with mutliple time pickers</label> <description></description> <fieldset submitButton="false"> <input type="dropdown" token="source_tok" searchWhenChanged="true"> <label>Select a source type</label> <choice value="*">All</choice> <search> <query>index=_internal | stats count by sourcetype</query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <fieldForLabel>sourcetype</fieldForLabel> <fieldForValue>sourcetype</fieldForValue> <prefix>sourcetype="</prefix> <suffix>"</suffix> <default>splunkd</default> </input> <!-- Do not define token for global timer --> <input type="time" searchWhenChanged="true"> <label>Select time range</label> <default> <earliest>-7d@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Global timer</title> <chart> <search> <query>index=_internal $source_tok$ | timechart count</query> </search> </chart> </panel> <panel> <title>Local timer</title> <!-- Define token for local timer --> <input type="time" searchWhenChanged="true" token="local_time_input_tok"> <label>Select time range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <chart> <search> <query> index=_internal $source_tok$ | timechart count </query> <!-- Use modifiers to token for a timer --> </search> <earliest>$local_time_input_tok.earliest$</earliest> <latest>$local_time_input_tok.latest$</latest> </chart> </panel> </row> </form> Your dashboard will display like follow: <form> <label>Form with mutliple time pickers</label> <description></description> <fieldset submitButton="false"> <input type="time" searchWhenChanged="true" token="local_time_input_tok"> <label>Select time range</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>Global timer</title> <chart> <search> <query>|savedsearch ''name of your scheduled''search </query> <earliest>$local_time_input_tok.earliest$</earliest> <latest>$local_time_input_tok.latest$</latest> </search> </chart> </panel> </row> </form> Please, excuse me because i modified the xml code. ... View more