Even though your labels appear to be empty, they are   so they occupy some space. Try adding #link_button_1 label, #link_button_2 label, #textbox_1 label, #textbox_2 label{ display: none; } ... View more

I haven't used dbxquery but I suspect Submit_Date is coming back as a string, so you need to parse the string into a time value ... | eval Time=strptime(Submit_Date, "<whatever time format the query is returning") ... You can then add the 10.5 hours to this ... | eval Time=Time+(10.5*3600) ...  (you might be able to put the addition at the end of the previous eval) Then, to change the way it is displayed, use fieldformat ... | fieldformat Time=strftime(Time,"%Y-%m-%d %H:%M:%S") ... ... View more

Hi @aditsss  Now you need to build your choice of panels into a selection string for the summary query. Add these lines in the multiselect panel before the default e.g. ... <prefix>(</prefix> <valuePrefix>OrgFolderName ="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <suffix>)</suffix> <default>All</default> ... and add another eval at the end of the change e.g. ... <eval token="org_choice">if(mvfind('form.Org',"All")=0,"OrgFolderName!=imhe_b",$Org$)</eval> </change> ... Finally, modify the query for the summary panel ... <query>index=abc sourcetype="xyz" $org_choice$ (BuildResult=SUCCESS) ... I noticed that you still have $Org$ at the end of your other queries - this should be removed as it will affect the results of these queries. ... View more

mvzip the two mv fields together, mvexpand to split into multiple events, rex out the two values, eval a new field using one field value for the name and the other field for the value, then use stats to join the events back together | streamstats count as event_no | eval combined=mvzip(field1, field2) | mvexpand combined | rex field=combined "(?<key>[^,]*),(?<value>.*)" | eval {key}=value | stats values(*) as * by event_no ... View more