I am Trying to build a Dashboard based on the below search with a drop down picker for time span and a drop down Button for sourcetype. When I ran the search without the pickers it runs great I get multiple actions log in, log out, and Null to name a few. But When I use the search with time pickers the only action column I get is null. I have checked answers and the docs but I am unable to figure out why the other columns are not showing up when I use the picker/tokens in the search. Base Search: sourcetype="YYY_XXX" |timechart span=15m count by Action limit=0 Dashboard search with Tokens: ?CU? |timechart $Span$ count by Action limit=0 Dashborad XML Stats Page Credit Union YYY1 YYY2 YYY3 _xxx sourcetype= Span Default 1 min 5 min 10 min 20 min 1 hour 2 hour ?CU? |timechart $Span$ count by Action -4h@m now 1 20 none none false progressbar false false true ... View more

I have 2 Sourcetypes A and B with 2 important Fields SSN and Number. I want to compare all of the SSN and number's from Sourcetype A to Sourcetype B I then return Results that only show up in Sourcetype B Sourcetype A SSN number 1111 12345 (drop this because it matches B) 2222 12345 (drop this because it is sourcetype A even though it doesn't match) Sourcetype B SSN number 1111 12345 (drop this because it matches A) 2222 11111 (keep this because it doesn't match anything in A and it is Sourcetype B) I am really stuck on this one not even sure where to start. ... View more