try this? a mix of rex and fields trickery server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="" Account_Name="" | Table Account_Name _time | rex field=Account_Name "(?<user>\$\w+)" | fields - Account_Name This output should give you a new field called User and Omit the Server## ... View more

Saved searches are app specific. You need to rebuild the search in the new app and save it. ... View more

Sounds like this dashboard has a problem with the time range mismatch. Does your search app have a defaulted time range set from earlier searches? It may have persisted in the 'search' app, but never was set in your new one. I'd assume you've gone through the manager and also checked out the XML running the dash to verify the time range is in fact where you want it? ... View more

So your dash is displaying inline search results instead of cached search results? Just want to understand this correctly before swinging at it. ... View more