Please try not to keep editing and deleting messages, as I just lost my reply as a result. So here again... Try this source=abc type=Changed event_id="*" (msg="consumed event" OR (msg=" finished processing" AND duration>1) ``` Rename consumed customer Id ``` | rename event.data{}.id as id ``` Join start/finish events together for the event_id | stats count values(duration) as duration values(id) as id by event_id ``` and filter only for customer ``` | where id="XYZ" AND count=2 ``` Get the average ``` | stats avg(duration) as duration This assumes there is more than one sequence per customer. Will one customer have more than one pair of events for each event id? This counts the events to make sure that there are two events per event_id and then filters for your customer and then gets the average of all events     ... View more

This example will calculate those ranks from the base data of Student+Score, which uses eventstats to build the collection of scores (stats list) and then mvfind to find the position in the list and then calculate rank. | makeresults count=10 | fields - _time | streamstats c as Score | eval Student="Student ".(11 - Score) | table Student Score ``` Above simulates your data ``` ``` Generate list of scores and find position in results ``` | sort Score | eventstats count list(Score) as Scores | eval pos=mvfind(Scores, "^".Score."$") ``` Now calculate ranks ``` | eval Rank_Inc=round(pos/(count-1)*100, 0) | eval Rank_Exc=round((pos+1)/(count+1)*100, 0) | fields - Scores pos count The bit from sort score is what you want  ... View more

That sort of functionality is quite involved. The descriptions below are for Simple XML  https://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML https://docs.splunk.com/Documentation/Splunk/9.1.1/Viz/tokens https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect In your dashboard you will need something like <drilldown> <set token="clicked_url">$row.URL$</set> <set token="run_collect"></set> </drilldown> You will need a global search that does the collect, e.g. something like this will create a new row with your user/URL and collect that to your index. This search is dependent on the run_collect token being set, so will only happen when the user clicks the row. It will unset the token at the end, so it can run again. <search depends="$run_collect$"> <query> | makeresults | eval user=$env:user|s$ | eval URL=$clicked_url|s$ | collect index=your_index </query> <done> <unset token="run_collect"> </done> </search> As to hiding the data on the dashboard, is this to be hidden forever or just in this version of the dashboard? Much will depend on that. You don't actually need to collect it to an index, you could write this information to a CSV lookup, which may be a better option if you want to hide this information all the time once clicked. In that case you could use that as a lookup to filter previous clicked information. Anyway, this is a fairly complex use case for a dashboard - it's certainly all possible, but this is a bit more involved for a basic dashboard. This is NOT applicable to dashboard studio - you mention both in your question tags. In principle the approach could be the same, but the technical implementation is not as above.   ... View more

In the original, you had 9 series and in the second, you have 5. Your aggregation is using median(minsElapsed) so it's quite possible that the media is going to be less than the 33 shown in the first graph. In the first graph, you have the A* series for Oct 10 appear to be 33, 10 and maybe 6, so if you combine all the values for all of these events, the median is likely to be different as it's the median of all 3 sets of events rather than the median on the single LOB value.   ... View more

Technically the search msg="*firewall off*" will not match the firewall has been turned off but assuming that's understood, then this may work for you index=abc msg="*firewall off*" OR msg="*system updated*" | streamstats time_window=30s dc(msg) as msgTypes count by hostname | where (match(msg, "firewall off") AND count=1) OR (count>1 AND msgTypes=1) | table _time, hostname, msg It uses streamstats to combine events within a 30 second time window - set that to your expected range. The where clause filters only those events where it just contains firewall off OR there are multiple firewall off messages, but no system updated message. ... View more