Here is a dynamic way to do it. This will count up mail servers and add them to the drop down box. If you 2 server it will show those two, if you have 100, it shows 100 servers. <input type="time" token="global_time" searchWhenChanged="true"> <label>Time frame</label> <default>Last 24 hours</default> </input> <input type="dropdown" token="Mailserver" searchWhenChanged="true"> <label>Mailserver</label> <search> <query>sourcetype=api "analyzed email count" | rex "xxx (?<server>\S+)" # Here you need to make a rex to extract name of your mail server | top limit=0 server <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> </search> <choice value="*">Any</choice> <fieldForLabel>server</fieldForLabel> <fieldForValue>server</fieldForValue> <default>*</default> </input> Then in you panel you add the following search: sourcetype=api "analyzed email count" $Mailserver$ | stats sum(mail_value) AS "Total" If you post some lines that show how mail server looks like, I can make the regex to extract it for you. ... View more

You need to use epoch times and the relative_time command with -60d : http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/CommonEvalFunctions ... View more

Yes, you can do base search NOT (sensor="disk-free" OR sensor="mem-usage") | chart values(value_raw) as values over host by sensor ... View more

Thanks for the response...I ran it but I get an error with the eval command stating that the arguments of the mvzip command is invalid. ... View more