What you want is a cascading input. First input populating search: sourcetype=mySourcetype | stats count by "State" First input token: state_token Second input populating search: sourcetype=mySourcetype State=$state_token|s$ | stats count by "City" Note the use of a |s filter with the state_token. This will add quote marks to capture states like North Dakota. ... View more