Hi Max, i implemented your hints into our dashboard. So the search macro now is index=our_index sourcetype="our_sourcetype" earliest=-1w latest=now
| dedup event_priority
| sort event_priority
| eval sel_priority_blank = event_priority + " "
| table event_priority sel_priority_blank _time
| rename event_priority as sel_priority _time as latest_record
| convert timeformat="%+" ctime(latest_record) And corresponding in the dashboard <fieldForLabel>sel_priority_blank</fieldForLabel>
<fieldForValue>sel_priority</fieldForValue> This works file so the problem is solved 😁 Regards, Norbert
... View more
