You would need to expand the event into multiple events, try something like this | mvexapnd 'data.environments{}.id'   ... View more

i ended up using the below with anomaly detection which got me as close in the timeframe i had   index=kubernetes app=nio env=prd tag=error | timechart span=1m count by app limit=0 | eventstats median("nio") as median | eval absDev=(abs('nio'-median)) | eventstats median(absDev) as medianAbsDev | eval lowerBound=(median-medianAbsDev*exact(4)), upperBound=(median+medianAbsDev*exact(3)) | eval isOutlier=if('nio' < lowerBound OR 'nio' > upperBound, 1, 0) | fields _time, "nio", lowerBound, upperBound, isOutlier, * ... View more

    Hi @mathiasy123    If your asking just for a basic panel that shows all alerts in a dashboard then it will be the below. You will need to make sure you are admin.  search to get all alerts and format nicely          |rest/servicesNS/-/-/saved/searches | search alert.track=1 | fields title author request.ui_dispatch_view eai:acl.sharing eai:acl.app         dashboard xml       <form> <label> Test</label> <row> <panel> <title>test</title> <table> <search> <query>|rest/servicesNS/-/-/saved/searches | search alert.track=1 | fields title author request.ui_dispatch_view eai:acl.sharing eai:acl.app</query> <earliest>-30m@m</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form>         ... View more