I wonder if someone may be able to help me please. I have the following 'Saved Accelerated Search' which I use as a data source in a dahsboard. index=main auditSource="matching" auditType="Tx*" detail.input-ida-request="*" | rex field="detail.input-ida-request" "\"firstName\":{\"value\":\"(?<idaFName>[^\"]+)" | rex field="detail.input-ida-request" "\"surnames\":\[\{\"value\":\"(?<idaSName>[^\"]+)" | rex field="detail.input-ida-request" "\"dateOfBirth\":{\"value."\:"\"(?<idaDOB>[^\"]+)" | rex field="detail.input-ida-request" "\"lines\":\[\"(?<Street>[^\"]+)\",\"(?<Town>[^\"]+)\",\"(?<Country>[^\"]+)\"" | rex field="detail.input-ida-request" "\"postCode\":\"(?<idaPCode>[^\"]+)" | rex field="detail.input-ida-request" "\"NationalInsuranceNumber\":\"(?<idaNINO>[^\"]+)" | rex field="detail.input-ida-request" "\"SUT\":\"(?<idaSUT>[^\"]+)" | eval date=idaDOB | eval idaDOB=replace(idaDOB,"(\d+)-(\d+)-(\d+)","\3/\2/\1") | fillnull value="Not Provided" idaFName idaSName idaDOB idaAddress idaPCode idaSUT idaNINO | eval idaFullName= idaFName." ".idaSName | eval idaFull_Details= "DOB: ".idaDOB.", Address: ".Street." ".Town." ".Country.", NINO: ".idaNINO.", SAUTR: ".idaSAUTR | makemv delim=", " idaFull_Details | rex field="detail.output-cid-response" "\"firstName\":\"(?<cidFName>[^\"]+)" | rex field="detail.output-cid-response" "\"lastName\":\"(?<cidSName>[^\"]+)" | rex field="detail.output-cid-response" "\"dateOfBirth\":\"(?<cidDOB>[^\"]+)" | rex field="detail.output-cid-response" "\"sutr\":\"(?<cidSUT>[^\"]+)" | rex field="detail.output-cid-response" "\"nino\":\"(?<cidNINO>[^\"]+)" | rex field="detail.output-errors" "(?<ErrorCode>[^\][]+)" | fillnull value="Not Provided" ErrorCode cidFName cidSName cidDOB cidSAUTR cidNINO | rex mode=sed field=cidDOB "s/(\d\d)(\d\d)(\d\d\d\d)/\1\/\2\/\3/g" | eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt) | eval cidFull_Details= "Firstname: ".cidFName.", Surname: ".cidSName.", DOB: ".cidDOB.", NINO: ".cidNINO.", SUT: ".cidSUT | makemv delim=", " cidFull_Details | table idaFullName idaFull_Details cidFull_Details ErrorCode generatedAt | rename idaFullName TO "Customer Name", idaFull_Details TO "Customer Details", cidFull_Details TO "Cid Response", ErrorCode TO "Error Code", generatedAt TO "Date and Time of Submission" On the dashboard I have a drop-down menu with a list of users names with the token "username" Then on a separate panel I have created a table of results. What I'd like to do is filter the table of results by matching the token "username" with the field "idaFullName". I have tried these lines in my dashboard without success: <searchString>| savedsearch "Digital Verify and Match" | where idaFullName="$username$"</searchString> <searchString>| savedsearch "Digital Verify and Match" idaFullName="$username$"</searchString> Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the the search below to return values in a table. auditSource="cato-filing" auditType="FilingStarted" | dedup "detail.Filing ID" | table "detail.*" What I'd like to do is make this more efficient by changing the dedup to stats dc . Now I have used stats dc before, so I tried auditSource="cato-filing" auditType="FilingStarted" | stats dc(detail.Filing ID) By "detail.*" , but for the life of me, I can't work out how to return the table of results, because my effort returns no results. I just wondered whether someone may be able to look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more