give that field to search for a default value which is not appearing in the list (you will need to use the dashboard sourcecode editor).  <input type="checkbox" token="field10"> <label>Aufteilung</label> <choice value="inst">System.Touchpoint</choice> <choice value="datasource">Lauf</choice> <choice value="robotId">Client</choice> <delimiter>.".".</delimiter> <default>x</default> </input> in the search query use an if to set your own default: ... | eval x=inst | eval gruppe=$field10$ | timechart $field3$(awz) by gruppe</query>   ... View more

ok..but my twistlock is cloud based , how can integrate syslog-ng with twistlock ... View more

| rex "(?<VMX>[^\/]+)\.vmx"   This one works...thanx for ur help ... View more

Hi @itishree, As you can see, I sent to you two regexes with the old logs you shared, two versions because you sent two different versions of logs (before results you'gettin' in, then sample logs). So, could you share a sample of all the kind of logs? Anyway, the regex to extract from the results you shared is   | rex "\w*\/[^\/]*\/(?<my_field>\S*)\s*$"   that you can test at https://regex101.com/r/m9VYnT/1, but probably isn't correct. Ciao. Giuseppe ... View more

Exactly you have to create panel to shoe city details or anything else you would like to show. ... View more