Thank you Gyslainlatsa.
I used the following and cannot get the results to populate on a dashboard panel:
VPN Search Clone
VPN search and session_ID
<input type="text" token="user" searchWhenChanged="true">
<label>Enter a user:</label>
<default>user1</default>
</input>
<input type="multiselect" token="session_id" searchWhenChanged="true">
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>session_id="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<choice value="*">ALL</choice>
<search>
<query>sourcetype="f5:bigip:apm:syslog" user=$user$ | stats count by session_id</query>
<earliest>0</earliest>
<latest></latest>
</search>
<fieldForLabel>session_id</fieldForLabel>
<fieldForValue>session_id</fieldForValue>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<panel>
<event>
<search>
<query>sourcetype="f5:bigip:apm:syslog" user=$user$ session_id=$session_id$</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<option name="wrap">true</option>
<option name="dataOverlayMode">none</option>
<option name="count">10</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>
... View more
