Example: a series of events all have the same incident number (1170820) outlining the lifecycle of the ticket (from open to close). I want to be able to create a field for when the incident was closed so that the time can be easily identified on a dashboard.  (Time | Closed Time | Computer Name | ETC). How can I isolate a sub-search to track the latest ticket in a series of incidents so that I can set a field for "Closed time"?     ... View more

Creating a dashboard to track when users badge into and out of different areas. Problem: If I do a basic search for a user_id, I get back multiple listings for that user with different timestamps for each badge use, great. I created a dashboard that allows me to : search all/specific user(s) by ID and allot what timeframe to search in. On the dashboard at the bottom for "user activity", it will only display1 event per user_id listed in that timeframe (or just 1 event for a specific user when searched), even if a user badged in multiple times.   Request: How can I make it so all instances of a badge being used are shown? I would prefer to be able to do a dropdown window type of setup when all events for a user show up under their ID, but I can live with all instances during that timeframe being shown in series.   -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Source: <form theme="dark" refresh="300"> <label>Employee Tracker</label> <search id="base_search"> <query>index="argus" argus_passage | table _time, user_id, building_name, portal,from_area, to_area</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="user_id" searchWhenChanged="false"> <label>Search a UserID:</label> <choice value="*">All</choice> <search base="base_search"> <query>| stats count by user_id</query> </search> <fieldForLabel>user_id</fieldForLabel> <fieldForValue>user_id</fieldForValue> <default>*</default> <initialValue>*</initialValue> </input> <input type="time" token="time_token" searchWhenChanged="false"> <label>Choose a TimeFrame:</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <single> <title>Total Users for Desired TimeFrame</title> <search base="base_search"> <query>| dedup user_id | stats count</query> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="height">251</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0x006d9c"]</option> <option name="underLabel">Total Users</option> <option name="useColors">1</option> </single> </panel> </row> <row> <panel> <chart> <title>Portal Usage</title> <search base="base_search"> <query>| search user_id=$user_id$ | dedup user_id | stats count by portal</query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <chart> <title>Ingress Portal</title> <search base="base_search"> <query>| search user_id=$user_id$ | dedup user_id | stats count by from_area</query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> </chart> </panel> <panel> <chart> <title>Egress Portal</title> <search base="base_search"> <query>| search user_id=$user_id$ | dedup user_id | stats count by to_area</query> </search> <option name="charting.chart">pie</option> <option name="charting.drilldown">none</option> </chart> </panel> </row> <row> <panel> <table> <title>User Activity</title> <search base="base_search"> <query>| search user_id=$user_id$ | dedup user_id | sort -count</query> </search> <option name="count">50</option> <option name="drilldown">none</option> </table> </panel> </row> </form>        ... View more