Have you tried to just use $info_sid$ in href? | eval application_name = "<a href=https://<hostname>:8000/en-US/app/search/security_events_dashboard?form.field2=&form.application_name=" . application_name . ">" . application_name . "</a>" | eval email_subj="Security Events Alert", email_body="<p>Hello Everyone,</p><p>You are receiving this notification because the application has one or more security events reported in the last 24 hours..<br></p><p> Please click on the link available in the table to fetch events for specific application.</p> </p><p>To view splunk results <a href=https://<hostname>:8000/en-US/app/search/search?sid=".$info_sid$.">Click here</a></p>" If your scheduled search has already sent an alert, you can go to "Activities" menu and find the exact URL for that search.  I don't believe that Splunk accept anything except the dotted numerals SID. ... View more

Look in the internal python.log for "sendemail" to see if Splunk had a problem sending the email to your SMTP server.  If there's nothing there then contact your email admin for help. ... View more

First things first - see the changelogs for known bugs - sendemail.py is known to have had a few bugs here and there. ... View more

Thank you very much @dtburrows3!! I can see the results for each application but looks like the map does not work for me. I also tried to use just sendemail command but it does not work either. When i give the email id manually i can see an email getting triggered but not when i use the field name which has email id's. Can you provide suggestion on this? Thanks in advance! ... View more

Hi @sbollam , you have to create three cascade dropdown list, concatenated uing the tokens of the previous ones, something like this: <fieldset submitButton="false"> <input type="dropdown" token="application"> <label>Application</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Application</fieldForLabel> <fieldForValue>Application</fieldForValue> <search> <query> | inputlookup my_lookup.csv | dedup Application | sort Application | table Application </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="environment"> <label>Environment</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>Environment</fieldForLabel> <fieldForValue>Environment</fieldForValue> <search> <query> | inputlookup my_lookup.csv WHERE Application=$application$ | dedup Environment | sort Environment | table Environment </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> <input type="dropdown" token="index"> <label>index</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>index</fieldForLabel> <fieldForValue>index</fieldForValue> <search> <query> | inputlookup my_lookup.csv WHERE Application=$application$ AND index=$index$ | dedup index | sort index | table index </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset> Ciao. Giuseppe ... View more

Hi @sbollam  did you try my example code? ... View more

@ITWhisperer , Thanks a ton!! It worked like a charm. ... View more

@sbollam  Using strictly Simple XML, you'll need to use separate searches and standalone pie charts as @richgalloway suggested. You can also use CSS to manipulate the dashboard display. I suggest posting a new question in an appropriate category for more information on using CSS to manipulate trellis output in dashboards. ... View more

@sbollam please try the following run anywhere example. See if it fits your needs <form> <label>Dynamically Send the Token</label> <init> <unset token="runSearch"></unset> <unset token="showInput2"></unset> <unset token="showInput3"></unset> </init> <fieldset submitButton="false"> <input type="dropdown" token="input1" searchWhenChanged="true"> <label>input1</label> <choice value="1">1</choice> <choice value="2">2</choice> <change> <condition value="1"> <set token="showInput2">true</set> <unset token="showInput3"></unset> <unset token="runSearch"></unset> <unset token="form.input3"></unset> </condition> <condition value="2"> <set token="showInput3">true</set> <unset token="showInput2"></unset> <unset token="runSearch"></unset> <unset token="form.input2"></unset> </condition> </change> </input> <input depends="$showInput2$" type="dropdown" token="input2" searchWhenChanged="true"> <label>input2</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>value</fieldForValue> <search depends="$showInput2$"> <query>| makeresults count=12 | fields - _time | streamstats count as sno | eval prev=sno-1 | eval label=strftime(relative_time(now(),"@y+".prev."mon"),"%b") | eval value="earliest=\"@y+".prev."mon\" latest=\"@y+".prev."mon+1d-1s\""</query> <earliest>-1s</earliest> <latest>now</latest> </search> <change> <condition match="isnotnull($value$)"> <set token="runSearch">$value$</set> </condition> <condition> <unset token="runSearch"></unset> </condition> </change> </input> <input depends="$showInput3$" type="dropdown" token="input3"> <label>input3</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>value</fieldForValue> <search depends="$showInput3$"> <query>| makeresults | fields - _time | eval label="yesterday",value="earliest=-1d@d latest=-0d@d-1s"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <change> <condition match="isnotnull($value$)"> <set token="runSearch">$value$</set> </condition> <condition> <unset token="runSearch"></unset> </condition> </change> </input> </fieldset> <row> <panel> <table> <search depends="$runSearch$"> <query>| makeresults | eval inputValue=$runSearch|s$</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more