This seems to be an excellent tip. But, it no works for me. I get two rows back from as search - sorted by _time. Each row has a field called UserAction. One row (the latest) has a UserAction value of "Off", the earlier row has a value of "On" Ideally I would like to show only one row - "On" and when the "Off" comes in I would like to hide that row. I have tried two panels in a parent dashboard - my idea was to hide the panel that has the "On" search result. I would also like to have the "Off" panel hidden on the parent dashboard. I have tried things as shown here - but it seems the second panel is always hidden regardless of my token <set token="showPanel">true</set>. If I set it to false - the dashboard remains hidden. I am missing something  but have not yet found what I am missing Thanks for a helpful resource eholz1 ... View more

This works, but when I display more than four quarters I have an issue. It displays 2014-Q4 before 2015-Q3 which I don't want. If I could do this in reverse alphabetical order it would work. ... View more

It will depend how exactly JSON parsing is configured. You can set INDEXED_EXTRACTIONS=json in props.conf and then the JSON fields will be extracted on the indexer, or even earlier on a heavy forwarder if you are using one. So if you are using INDEXED_EXTRACTIONS=json then I think you need to change the limit on all indexers and heavy forwarders. In this case data that is already in your indexes will not benefit. On the other hand, you can also do JSON parsing at search time using KV_MODE=json in props.conf, the spath command or the spath() eval function. If you're doing any of these then you'd want the setting on the search head. It's conceivable you could also need the increased cutoff on the indexers as well because I don't see why JSON parsing couldn't be delegated to the indexers in a distributed environment. Obviously for JSON parsing at search time any changed cutoff will apply to previously indexed data as well as data indexed after the change. ... View more