@paranjith The throttling has fixed my issue. Thank you ... View more

@whrg It's attached to the question as alert.png. As far as the real-time is concerned, we're using real-time because we have single value panels that turn yellow to warn and red to indicate "down" for several applications. The operators who are on-call will only be interested in being alerted when something is at the warn or down state. ... View more

@woodcock Here is the xml in it's entirety. When I click on a row in the first table, I need it to pass the 'LobNameTok' token to the "Detail View" table (second table), so that the second table shows information that is only pertinent to that lob. See my where clause. From testing that I've done yesterday, I've concluded that the token IS being recognized by the second table when I click a row in the first. However, nothing is loading in the second table, it's just empty. I thought that perhaps it was an issue with lobName being a field that I extracted with rex() and not an actual field in my index. Maybe I have another issue that I'm not seeing. <search> <query>index=ssi_rtc ("handled request with state Success" OR "handled request with state Errored") | where isnull(webService) | rex "message\" : (?&lt;server&gt;\w+)\.\.(?&lt;lobName&gt;\w+(\-[a-zA-Z]+){0,1})\-(?&lt;transactionType&gt;\w+)\." | where transactionType="270" | rex "\"RequestReceivedFromClientTimeUtc\"\:\"(?&lt;requestReceivedTimeText&gt;.+?)\"" | rex "\"ReplySentToClientTimeUtc\"\:\"(?&lt;replySentTimeText&gt;.+?)\"" | eval requestReceivedTime = strptime(requestReceivedTimeText,"%Y-%m-%dT%H:%M:%S") | eval replySentTime = strptime(replySentTimeText,"%Y-%m-%dT%H:%M:%S") | eval processingTimeInSeconds = replySentTime - requestReceivedTime | stats avg(processingTimeInSeconds) as TimeAtLobSeconds by lobName | eval TimeAtLobSeconds = round(TimeAtLobSeconds, 0) | eval isFailure = if(TimeAtLobSeconds &gt; 20, 1, 0) | where (isFailure == 1) | table lobName TimeAtLobSeconds | rename TimeAtLobSeconds as "Avg. Time at Lob (seconds)" | sort -"Avg. Time at Lob (seconds)"</query> <earliest>$ThresholdTime.earliest$</earliest> <latest>$ThresholdTime.latest$</latest> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="LobNameTok">$row.lobName$</set> </drilldown> </table> </panel> <panel> <title>270 - Payer Latency (Detail View)</title> <table> <search> <query>index=ssi_rtc ("handled request with state Success" OR "handled request with state Errored") | rex "\"message\"\s\:\s(?&lt;server&gt;[A-Z]+)\.\.(?&lt;lobName&gt;[A-Z].+?)\." | where (lobName == $LobNameTok$ and isnull(webService)) | eval requestReceivedTime = strptime(requestReceivedTimeText,"%Y-%m-%dT%H:%M:%S") | eval replySentTime = strptime(replySentTimeText,"%Y-%m-%dT%H:%M:%S") | eval processingTimeInSeconds = (replySentTime - requestReceivedTime) | stats avg(processingTimeInSeconds) as TimeAtLobSeconds by lobName | table lobName TimeAtLobSeconds | rename lobName as "Lob Name", TimeAtLobSeconds as "Time at Lob" | sort -_time</query> <earliest>$ThresholdTime.earliest$</earliest> <latest>$ThresholdTime.latest$</latest> </search> ... View more

Sorry, I left out the set statement. <drilldown> <set token="LobNameTok">$row.lobName$</set> </drilldown> ... View more

Ah, I see! It's always nice when you can condense your query. I wasn't familiar with the makeresults command; so that helps as well. Thanks DMohn. ... View more

That worked like a charm. Thank you so much. ... View more