Hi all! I want to create a pulldown switcher in one of my charts in my view. Is it possible to implement this is XML? If so, could someone help point me in the right direction? ;_; I have already seen the UI example app, but I can't figure out how it works what I mean by "in one of my charts in my view", is it modifies the chart similar to the chart in the photo below: ~Thanks in advance! ... View more

Hi all, I'm currently working on a custom view with drop-down options. I have a populating search for the options in these drop-down menus, however, it currently take 30 minutes or more for the options to load and show up in the drop-down menus. <searchTemplate>sourcetype=trialdl country=$country1$ product_name=$product$ download_agent=$dlagent$ | timechart count</searchTemplate> <fieldset> <input type="dropdown" token="country1"> <label>Select a Country</label> <populatingSearch fieldForValue="country" fieldForLabel="country"> <![CDATA[sourcetype="trialdl" | lookup geoip clientip as ip_address | stats count by country]]> </populatingSearch> </input> <input type="dropdown" token="product"> <label>Select a Product</label> <populatingSearch fieldForValue="product_name" fieldForLabel="product_name"> <![CDATA[sourcetype=trialdl product_name=* | stats count by product_name]]> </populatingSearch> </input> <input type="dropdown" token="dlagent"> <label>Select a Download Client</label> <populatingSearch fieldForValue="download_agent" fieldForLabel="download_agent"> <![CDATA[sourcetype=trialdl download_agent=* | stats count by download_agent]]> </populatingSearch> </input> <input type="time"> <default>Last 30 days</default> </input> </fieldset> In the code snippet above, I have three drop-down list that all take a veryyy long time to populate. Has anyone else experienced this problem? Know a solution to this? Thanks in advance! ... View more

I've successfully downloaded the app and when I try my search, I get some matching events, but nothing appears on the map... I know this is incorrect, because I should be getting a number of countries in my results here's my search: sourcetype="t_test" | lookup geoip clientip as ip_address | top limit=10000 client_country Anyone know what might be the problem? I want to have the map display for my dashboard ... View more

Hi! Is it possible to narrow down this search so that it would group these results by "Interface" and "Mozilla" versus the results I provided below? I want to group all the results into more generalized groups for a simpler dashboard panel. All these results are in the same field called "user_agent", but I would like to narrow down this search. Anyone know how this could be done? I was thinking of searching for just by keywords? Because most of my results are either "Interface...blah blah" or other... blah blah. example results 1 "Interface (aaaf4b;win;1.8.3.3;Win7)" 2 "Interface (aa0b;win;1.8.3.3;WinXP)" 3 "Interface (aa04b;win;1.8.3.3;Vista) 4 "Interface (8e0a;mac;1.8.3.3;OS X 10.6.8)" 5 "Interface (8ea;mac;1.8.3.3;OS X 10.7.4)" 6 "Interface (8ec0a;mac;1.8.3.3;OS X 10.7.3)" 7 "Interface (aa04b;win;1.8.3.3;unknown)" 8 "Interface (8e0a;mac;1.8.3.3;OS X 10.5.8)" 9 "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WW64; Trident/5.0;CC2; 10 "Interface" 1124 0.234167 11 "Interface (8ec0a;mac;1.8.3.3;OS X 10.7.0)" 12 "Mozilla/4.0 (compatible; MIE 6.0; Windows NT 5.1; V1; 13 "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident 14 "Interface (8ece0a;mac;1.8.3.3;OS X 10.6.3) 15 "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; 16 "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)" ... View more