I am trying to recreate a report from MS Access in Splunk - basically in order to move away from Access completely. I am using db connect to search various databases and I have my searches correct but I cannot figure out how to pass the fields I am getting to create a whole new dashboard panel. I hope this illustrates what I am attempting (and who knows, maybe there's an add-on to help with this I am unaware of?). [time picker] Search1 Fields from db1: [date/time(based on time picker)][Location][Total1] Search2 Fields from db2: [date/time(based on time picker)][Location][Total2] Search3 Fields from db3: [date/time(based on time picker)][Location][Total3] Need to have a new dashboard based on these quantities... New Dashboard: [date/time(based on time picker][Location(should match from all 3 searches)][Difference in totals] Tokens seem to require specific values and I am not sure how mapping would work here. ... View more

The dashboard panel works great except that due to the multi-select and the options in the query the initial page is waiting for input from the multi-select box and I cannot get the wildcard * to select all. I would like to make the multi-select default 'all' but cannot get it to work. 'No results found.' Edit: Posting code works a little different here than other sites. <label>Date Range</label> <default> <earliest>-2d@d</earliest> <latest>now</latest> </default> <change> <eval token="form.et">strftime(relative_time(now(),'earliest'), "%F %T")</eval> <eval token="form.lt">strftime(relative_time(now(),'latest'), "%F %T")</eval> </change> </input> <input type="multiselect" token="code" searchWhenChanged="true"> <label>Code</label> <choice value="">All</choice> <choice value="1">1</choice> <choice value="2">2</choice> <choice value="3">3</choice> <delimiter> OR </delimiter> <valuePrefix>Code = '</valuePrefix> <valueSuffix>'</valueSuffix> </input> <query>| dbxquery query="SELECT Date,ID,City,Amount,Code FROM \"Safe\".\"dbo\".\"Data\" WHERE ($code$) AND (Date &gt;= '$form.et$' AND Date &lt;= '$form.lt$')" connection="database" | sort num(City)</query> ... View more