When you do a | stats count as EventCount it will rename count to EventCount. Believe that search should have looked like this to work: [Search string] | stats count as EventCount by host, SupportGroup | where EventCount > 100 | stats count(host) by SupportGroup If the rename to EventCount was not there it would have worked the first time. Could have been a typo. Travis. ... View more

Looking at your first two requests, I believe the following should meet your needs: 1) [Search String] | stats count by host | where count > 100 -- Obviously you can use whatever search, or whatever stats you want. 2) Your first report could be: [Search string] | stats count as EventCount by host, SupportGroup | where count > 100 | stats count(host) by SupportGroup For the dashboard, I think you should be able to do a standard drill down in the Advanced XML view for 3 and 4, but I'm not a drilldown expert. I'd recommend looking through the example here for having cascading dashboards, and seeing if you can copy and modify that enough to fit your needs. Alternatively, someone else might step and and provide more specific advice for you. If you run into questions with building dashboards, you can always also grabbing UI Examples off Splunkbase and look through some of the examples there. ... View more