The Save As dashboard panel on the RHS of the screen is how you can convert your search results into a dashboard panel Perhaps you want to have a distinct count of the IP's by signature, dest, severity? sourcetype="nessus" OR sourcetype="nessus:scan" (severity="critical") | stats dc(IP) by dest, severity, signature The above would assume your IP field is called "IP" and that you want it split by all three of those items... ... View more

Thanks for the insight on the dashboards. Much appreciated. ... View more