The time selector criteria of a search will only run on the _time value of the raw events - which don't exist here since you have a lookup file. Your options: If you want to filter on a field of those events, you would have to add in your own logic. Most do this by creating some static items in an input selector - the token of which is passed to the search as criteria against those lookup entries. Index the lookup file data (instead of using a lookup file) with one of the fields being processed as the _time value. Then you'll be able to do this using the raw events. If still is no good, we can talk about the goal of the dashboard itself and make sure that we haven't overlooked a different solution all together. ... View more