Hi ITWhisperer,   Can you provide me the code for this if possible. So that I can create one close button on the top of hidden panel if possible.So that I can close that manually. Another possibility is having an additional row with the hide button which uses the same depends as the drilldown panel i.e. it is only shown when the drilldown panel is visible Thanks in advance ... View more

Hi ITWhisperer, I have  tried this in My drill down panel. By clicking on the rows of the drill down panel the panel is getting closed. I want if I can put one small button on drill-down dashboard by clicking on which I can close the drill down dashboard manually rather then setting tokens. XML for drill down dashboard <panel depends="$show_panel3$"> <title>Statistics of Timeout Exceptions</title> <table> <title>Timeout Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> <option name="drilldown">row</option> <drilldown> <unset token="show_panel3">true</unset> </drilldown> </table> </panel> ... View more

Hi ITWhisperer, Yes, I have tried this way and its closing on clicking of row. Is there any way that I can create one cross button or close button on top of the drill-down dashboard which by clicking on which dashboard will close . Rather then clicking on row. Can you suggest me on that. XML code Main panel code <panel> <single> <title>TIME</title> <search> <query>index="abc" sourcetype=xyz Timeout $Org$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="unit"></option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="useColors">1</option> <option name="showSparkline">1</option> <option name="trendDisplayMode">percent</option> <drilldown> <set token="show_panel3">true</set> <set token="selected_value3">$click.value$</set> </drilldown> </single> </panel>   Drilldown panel <panel depends="$show_panel3$"> <title>Statistics of Timeout Exceptions</title> <table> <title>Time Exceptions</title> <search> <query>index="ABC" sourcetype=XYZ Timeout |stats count by URL | sort -count </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="count">100</option> </table> </panel> ... View more

Can someone guide me on this. ... View more

Hi ITWhisperer, I have attached  the stastics screenshot for last 7 days. .  Can you check. Still TimeOut panel is coming as 0. XML <form theme="dark"> <label>Salesforce Performance Overview Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="OrgName"> <label> Org Name</label> <choice value="*">GCP1</choice> <choice value="ABC">ATM-PROD</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> <change> <eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval> </change> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query> <earliest>$tokTimeStartOfDay$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="useColors">1</option> <drilldown> <set token="show_panel3">true</set> <set token="selected_value3">$click.value$</set> </drilldown> </single> </panel> <panel> <chart> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel>  ... View more

Hi ITWhisperer, The time picker is same for both. Only I have pass the field1 earliest as the token for Timeout panel. I have attached one screenshot where I select last 30 days but its showing 0 count in timeout panel. I am selecting the vallues from date/time drop-down field. Its not showing the correct data in timeout panel irrespective of the date range I am selecting from date drop-down. XML <form theme="dark"> <label>Salesforce Performance Overview Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="OrgName"> <label> Org Name</label> <choice value="*">GCP1</choice> <choice value="ABC">ATM-PROD</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> <change> <eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval> </change> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query> <earliest>$tokTimeStartOfDay$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="useColors">1</option> <drilldown> <set token="show_panel3">true</set> <set token="selected_value3">$click.value$</set> </drilldown> </single> </panel> <panel> <chart> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> ... View more

Hi ITWhisperer, I have change the token value but still same issue is arriving. Can you please check on it. I have attached screenshot as well. Incorrect data is coming in timeout Panel. XML for 1st and 2nd panel: <form theme="dark"> <label> Overview Clone</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="OrgName"> <label> Org Name</label> <choice value="*">GCP1</choice> <choice value="ABC">AT</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> <change> <eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest'))-1,"@d")</eval> </change> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ |stats count </query> <earliest>$tokTimeStartOfDay$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="useColors">1</option> <drilldown> <set token="show_panel3">true</set> <set token="selected_value3">$click.value$</set> </drilldown> </single> </panel> <panel> <chart> <search> <query>index="ABC" sourcetype=XYZ Timeout $OrgName$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> ... View more

Hi ITWhisperer, Can you please guide me on this.   ... View more

Hi ITWhisperer, Its not showing the correct data in the timeout panel. I have attached the image as well. I have select the date range as 11th Sep to 11th Sep whose timeout data should be 3694 but its showing 2119. Also when I am selecting last 7 days its showing timeout data as 0. when I select sep 11 to sep 11 then it should show  3694 only which is actual data for sep 11.  And when I select last 7 days say sep 6 to sep 12 . Then it should show sep 12 data only not the  total data. And in the case where there is no data like suppose last 15 minutes,last 60 minutes then it should show "No result found" or "0" Below is my xml code: <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> <change> <eval token="tokTimeStartOfDay">relative_time(if(isnum('latest'),'latest',relative_time(now(),'latest')),"-1m@d")</eval> </change> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ |stats count </query> <earliest>$tokTimeStartOfDay$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <option name="rangeColors">["0xFF0000","0xFF0000","0xFF0000","0xFF0000","0xFF0000"]</option> <option name="useColors">1</option> <drilldown> <set token="show_panel3">true</set> <set token="selected_value3">$click.value$</set> </drilldown> </single> </panel>   ... View more

Hi ITWhisperer, Thanks for your Suggestion. Just one issue is there with it. Rest all its working properly . while showing time as below for the first panel. Its always showing latest timeout count even in the case where there is no data. Suppose I select date range as Today or last 4 hours or last 15 minutes from Date/Time drop-down (Data is not there for these particular time periods). Then also its showing the data in timeout panel as 1209  which is the latest timeout data that is of 12th September.(Yesterday). Even when I select data range as 11th sep to 11th sep then also in timeout panel its showing 1209 which is timeout data for 12th Sepetember. <earliest>-1d@d</earliest> <latest>@d</latest> Can you guide me on that. Below is my xml for First panel: <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count</query> <earliest>-1d@d</earliest> <latest>@d</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <drilldown> <set token="show_panel">true</set> <set token="selected_value">$click.value$</set> </drilldown> </single> </panel> ... View more

Hi ITWhisperer, I am able to show the  2nd panel trend correctly. But again First panel is showing the total count value for timeout not the latest one. I want if I select last seven days from the date drop-down the 2nd panel should show the trend for last 7 days (which is showing correctly) and 1st panel should show the latest timeout count not the total of count of 7 days.(Its showing total of 7 days) Can u guide me where I am going wrong with my first panel as its again showing total. Below is my xml code: <form theme="dark"> <label> Overview</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="Org"> <label>Org Name</label> <choice value="*">PROD</choice> <choice value="KMGb">ATMS</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <drilldown> <set token="show_panel">true</set> <set token="selected_value">$click.value$</set> </drilldown> </single> </panel> <panel> <chart> <title>TIMEOUT TREND</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time |stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.abbreviation">none</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.abbreviation">none</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.abbreviation">none</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> <option name="charting.chart">line</option> <option name="charting.chart.bubbleMaximumSize">50</option> <option name="charting.chart.bubbleMinimumSize">10</option> <option name="charting.chart.bubbleSizeBy">area</option> <option name="charting.chart.nullValueMode">gaps</option> <option name="charting.chart.showDataLabels">none</option> <option name="charting.chart.sliceCollapsingThreshold">0.01</option> <option name="charting.chart.stackMode">default</option> <option name="charting.chart.style">shiny</option> <option name="charting.drilldown">none</option> <option name="charting.layout.splitSeries">0</option> <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option> <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option> <option name="charting.legend.mode">standard</option> <option name="charting.legend.placement">right</option> <option name="charting.lineWidth">2</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> </chart> </panel> </form> ... View more

Hi ITWhisperer, I am able to see the latest count for timeout when I select date range as september 10 to september 11 in date dropdown that is 2 days so I am able to see 3694 which is timeout count value for september 11 not the total count. But along with 3694 count value  I am able to see  one arrow (-> with 0% and one trend line coming down the value) I only want 3694 count value to be displayed in this panel. Nothing else. And I need to create another panel where I should show the trend line for last 2 days or last 7 days whatever value I have selected from date drop down. In short I want two panels one will display the latest count and another should display the trend for the number of days I have selected. As of now I have only one panel which was displaying the count. Can you guide me on that. Below is my xml : <form theme="dark"> <label> Overview</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="Org"> <label>Org Name</label> <choice value="*">PROD</choice> <choice value="KMGb">ATMS</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ | bin span=1d _time | stats count by _time</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <drilldown> <set token="show_panel">true</set> <set token="selected_value">$click.value$</set> </drilldown> </single> </panel> </row> </form>   ... View more

Hi ITWhisperer, My requirement is like this: I have one dashboard which consists of several panels like Failure,TimeOut etc. The panels are showing count values like Timeout= 2161. Now suppose when I select Date as September 11 from the date dropdown the TimeOut panel is displaying count value of TimeOut as 3,694 . when I select Date as September 10 from the date dropdown the TimeOut panel is displaying count value of Failure as 4337. Now suppose I select date value from date dropdown as September 10 to September 11 its showing the count value for TimeOut as 8031. which is the total count of the two days 3694+4337.  I want when I select two days from date dropdown say september 10 to september 11. It should show the latest count that of timeout that is of september 11.that is 3694 not the total count of the two days 8031 which its showing currently. when I select 7 days it should show the latest Timeout count not the total count of 7 days on panel. Can you guide me how can I achieve that. Below is my xml code. <form theme="dark"> <label> Overview</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="Org"> <label>Org Name</label> <choice value="*">PROD</choice> <choice value="KMGb">ATMS</choice> .... ..... <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="field1" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </input> </fieldset> <row> <panel> <single> <title>TIMEOUT</title> <search> <query>index="ABC" sourcetype=XYZ Timeout $Org$ | stats count </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <option name="colorBy">value</option> <option name="drilldown">all</option> <option name="height">100</option> <option name="numberPrecision">0</option> <option name="rangeValues">[0,10,25,40]</option> <option name="trendDisplayMode">percent</option> <option name="trendInterval">-5m</option> <option name="unit"></option> <drilldown> <set token="show_panel">true</set> <set token="selected_value">$click.value$</set> </drilldown> </single> </panel> </row> </form>   Thanks in advance ... View more

Hi ITwhisperer, I want to see the fields which are not available in logs. There are some fields which are coming at the left as as selected fields and Interesting Fields when we check logs. I want to see all other fields that are present for particular index ,ns and app. so that I can add them in logs and create Dashboards.   ... View more

Hi ITWhisperer,   Sample logs 2020-09-10T02:23:14.927038622Z app_name=abc ns=xyz pod_container=init-vault pod_name=abc-deployment-74-tlzxv message=secrets file already exists; exiting ... 2020-09-10T03:52:26.646777037Z app_name=abc ns=xyz pod_container=init-vault pod_name=babc-deployment-17-rpn2h message=secrets file already exists; exiting ... host = lgpecpe.gso.bc.commessage = secrets file already existssource = /var/log/agent/tmp/containers.logsourcetype = container-log ... View more

Hi ITWhisperer, This is really helpful.  Just one suggestion needed . Can we use lookup table for drop-down values instead of hard coding the values as they are 30+ and may increase in future. Can you guide me on that. Below is the code for drop-down inputlookup: <input type="multiselect" token="name" searchWhenChanged="true"> <label> Name</label> <choice value="*">All Name</choice> <search> <query>|inputlookup abc.csv|table FolderName</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <fieldForLabel>FolderName</fieldForLabel> <fieldForValue>FolderName</fieldForValue> <prefix>(</prefix> <valuePrefix>FolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>*</initialValue> <default>*</default> </input>   The code that I am using currently with hard-coded values: <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <prefix>(</prefix> <valuePrefix>OrgFolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>All</initialValue> <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> <eval token="org_choice">if(mvfind('form.Org',"All")=0,"(OrgFolderName!=imhe_b AND OrgFolderName!=imhe_e",$Org$)"</eval> ....... ....... ....... ........ </change> </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <panel> <title>Summary of Average Build Times of all orgs over the selected time period.</title> <chart> <search> <query>index=abc sourcetype="xyz" (BuildResult=SUCCESS) $org_choice$ | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Org</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">Average Build Duration In Minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form> ... View more

Hi ITWhisperer, Is  something like this I need to do for summary tab. Can you please confirm. Below is my code: <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <prefix>(</prefix> <valuePrefix>OrgFolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <initialValue>All</initialValue> <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> <eval token="org_choice">if(mvfind('form.Org',"All")=0,"OrgFolderName!=imhe_b AND OrgFolderName!=imhe_e",$Org$)</eval> ....... ....... ....... ........ </change> </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <panel> <title>Summary of Average Build Times of all orgs over the selected time period.</title> <chart> <search> <query>index=abc sourcetype="xyz" (OrgFolderName!=imh_b AND OrgFolderName!=imhe_e) (BuildResult=SUCCESS) $org_choice$ | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Org</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">Average Build Duration In Minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form> ... View more

Hi ITWhisperer, Thank you so much for your help. I am new to splunk and its really helping me to learn splunk. I have one issue rest all issues are resolved. Out of 20 panels I have one panel as summary panel. Its like when I select "Merchant" from multi-select dropdown then summary tab should show summary of merchant for whatever time I selected(suppose 30 days) along with merchant individual tab. when I select "Force" and "Merchant" then total 3 panels should be displayed one summary showing summary to show the summary of "Force" and "Merchant" along with Force and Merchant individual tabs. Individual panels are working properly by the code you provided me. Can you please guide me on this. What token I should pass in summary panel to make it work. Below is my code: <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <initialValue>All</initialValue> <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> ....... ....... ....... ........ </change> </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <panel> <title>Summary of Average Build Times of all orgs over the selected time period.</title> <chart> <search> <query>index=abc sourcetype="xyz" (OrgFolderName!=imhe_b ) (BuildResult=SUCCESS) | eval BuildDurationInMinutes=round(BuildDuration/40000,1) | chart avg(BuildDurationInMinutes) as AverageBuildDurationInMinutes over OrgFolderName limit=40 | sort -AverageBuildDurationInMinutes</query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Org</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">Average Build Duration In Minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form> ... View more

Hi ITWhisperer, I changed it to mvfind.  The issue is when dashboard is first loaded with All Orgs as default  Its showing all panels but data for first panel only and that too wrong data.(I am selecting past 30 days its showing of yesterday) Also again there is issue with multiselect. When I select "Merchant" from multiselect then its showing data for merchant correct and then I select "Force" with merchant then its not showing data for  both Force  and merchant Also I am not able to select "AllOrgs" with individual values from multiselect.Also when I cross one value out of two say I cross Force from force and merchant in multiselect in that case also both force and merchant panels are displaying. Again when I am selecting "All Orgs" then also data of first panel is displaying not all panels. Below is my code: <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <initialValue>All</initialValue> <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> ....... ....... ....... ........ </change> </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form>   ... View more

Hi ITWhisperer, All the evals are under change clause but still same issue is arriving. Below is the code: <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <initialValue>All</initialValue> <default>All</default> <change> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfi('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> ....... ....... ....... ........ </change> </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form> ... View more

Hi ITWhisperer, I tried by adding"All" instead of "*". The dashboard is not displaying anything when"All Orgs" is coming in the drop-down by default when we loaded the dashboard for the first time. Also the multi select conditions are not working properly. Its like when I select "merchant" from the drop down then merchant panel is coming with data and then when I select force with merchant then only Force panel data is coming merchant data is not coming. Also when I cross one value out of two say I cross Force from force and merchant in multiselect in that case also both force and merchant panels are displaying. Again when I am selecting "All Orgs" then also data of first panel is displaying not all panels. Can you guide me where its going wrong. Below is my code <form theme="dark"> <label> Build Report </label> <fieldset submitButton="false" autoRun="true"> <input type="multiselect" token="Org" searchWhenChanged="true"> <label> Org Name</label> <choice value="All">All Org</choice> <choice value="accert">accert</choice> <choice value="atj">atj</choice> <choice value="force">force</choice> <choice value="merchant">merchant</choice> <choice value="control">control</choice> <choice value="gcpi">gcpi</choice> <choice value="ppp">ppp</choice> <choice value="theforce">theforce</choice> <choice value="gpof">gpof</choice> <choice value="hkin">hkin</choice> <choice value="ihh">ihh</choice> ....... ........ ....... <initialValue>All</initialValue> <default>All</default> <eval token="form.Org">case(mvcount('form.Org')=0,"All",mvcount('form.Org')&gt;1 AND mvfind('form.Org',"All")&gt;0,"All",mvcount('form.Org')&gt;1 AND mvfi('form.Org',"All")=0,mvfilter('form.Org'!="All"),1==1,'form.Org')</eval> <eval token="accert">if(isnull(mvfind('form.Org',"accert")),mvfind('form.Org',"All"),1)</eval> <eval token="atj">if(isnull(mvfind('form.Org',"atj")),mvfind('form.Org',"All"),1)</eval> <eval token="force">if(isnull(mvfind('form.Org',"force")),mvfind('form.Org',"All"),1)</eval> <eval token="merchant">if(isnull(mvfind('form.Org',"merchant")),mvfind('form.Org',"All"),1)</eval> <eval token="control">if(isnull(mvfind('form.Org',"control")),mvfind('form.Org',"All"),1)</eval> <eval token="gcpi">if(isnull(mvfind('form.Org',"gcpi")),mvfind('form.Org',"All"),1)</eval> <eval token="ppp">if(isnull(mvfind('form.Org',"ppp")),mvfind('form.Org',"All"),1)</eval> <eval token="theforce">if(isnull(mvfind('form.Org',"theforce")),mvfind('form.Org',"All"),1)</eval> <eval token="gpof">if(isnull(mvfind('form.Org',"gpof")),mvfind('form.Org',"All"),1)</eval> ....... ....... ....... ........ </input> <input type="time" token="field4" searchWhenChanged="true"> <label>Date/Time</label> <default> <earliest>-1d@d</earliest> <latest>@d</latest> </default> </fieldset> <row> <panel depends="$merchant$"> <title> Report for Merchant</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=merchant BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> <panel depends="$accert$"> <title> Report for accert</title> <chart> <search> <query>index=abc sourcetype="xyz" OrgFolderName=accert BuildResult=SUCCESS $Org$ </query> <earliest>$field4.earliest$</earliest> <latest>$field4.latest$</latest> </search> <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option> <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option> <option name="charting.axisTitleX.text">Date</option> <option name="charting.axisTitleX.visibility">visible</option> <option name="charting.axisTitleY.text">BuildDuration in minutes</option> <option name="charting.axisTitleY.visibility">visible</option> <option name="charting.axisTitleY2.visibility">visible</option> <option name="charting.axisX.scale">linear</option> <option name="charting.axisY.scale">linear</option> <option name="charting.axisY2.enabled">0</option> <option name="charting.axisY2.scale">inherit</option> </chart> </panel> </row> ........ ......... ......... </form> ... View more