This is also an issue for me (not using aggregations). All the $trellis...$ tokens don't work when passing to a custom search. My workaround was to copy the URI generated for my search, and insert the $trellis...$ token in the proper place (I used a |u for URL encoding but not sure it's necessary). When using the "Link to Custom URL" drilldown, the tokens work just fine. Downside is that now the user gets the  "Redirecting Away From Splunk" message prior to being redirected. ... View more

Ah....so even if the user deletes their report the job keeps running?  ... View more

Is this something I'd need to build my own app for? Thanks ... View more

@shazbot79  I know you've got your solution, but in terms of the principles behind stats vs join. Consider these two data sets Set 1 UserName,Field2 user1@abc.co.uk,aaaa user2@abc.co.uk,bbbb user2@abc.co.uk,cccc and then this data set 2 UserName,Fieldx user1@abc.co.uk,xxxx user2@abc.co.uk,yyyy user2@abc.co.uk,zzzz so, when you have a common field, you can either do the following join DataSet1 | join UserName [ DataSet2 | Fields UserName Field3 ] | stats values(*) as * by UserName  or using stats DataSet1 OR DataSet2 | stats values(*) as * by UserName Will achieve the same thing, but without the cost/limitations of using a subsearch.     ... View more

> I risk missing records which were opened outside of the window.  I think this should use csv to solve. ... View more

I should add the dates on the graph should be the Monday of each week so the incidents need to be grouped by week. Thanks ... View more