Hi vadlamudi, You can do this in a dashboard if you create a panel for each of those queries. Click "More actions" on the Query 1 table, select "edit drilldown" and then "Manage tokens on this dashboard". Then you can just set the REQUEST_ID token to $row.REQUEST_ID$ and the second panel will automatically update with the users preferences. Another option is to "Link to search" which will open a new window with the second query you specified, you can pass through the token the same way ($row.REQUEST_ID$). Hope this helps! ... View more

Search filters by role aren't actually limited to indexed fields, you can do this type of restriction at search-time. An idea I would have is to make an eventtype for each user/field filter. E.g. eventtype=user_1_building_filter  index=buildings building IN ("a","b","c") ... etc eventtype=user_2_building_filter index=buildings building IN ("f","g","h") ... etc   And then you could add these event types into the search filter for each of these user roles. This way you can make your conditions for each field as an eventtype and it will be quite easy to read in the search filter: eventtype=user_1_building_filter OR eventtype=user_1_other_filter   ... View more

Hi syazwani, What timeframes are you specifying for your searches? I suspect that's the reason why you're getting inconsistencies in your search.  In your enterprise security search you're specifying a 24 hour time period: earliest=-48h latest=-24h Which will give you different results depending on the time you run it. Try the following:  Todays current total: index=emailgateway action=* from!="" to!="" earliest=@d | stats count   Compare yesterday and today: index=emailgateway action=* from!="" to!="" earliest=-1d@d | timechart span=1d count as total   Simpler tstats command: | tstats summariesonly=true allow_old_summaries=true count from datamodel=Email where All_Email.action=* All_Email.orig_dest!="" All_Email.orig_src!="" earliest=-1d@d latest=now by _time span=1d   Using earliest=-1d@d will take the search back to the beginning of yesterday (12:00am). Whereas using earliest=@d will take you to the beginning of the current day. Hope this helps! ... View more

Hi jmatelun, You can auto-refresh certain data sources inside your dashboard. Click on whichever data source you'd like to automatically refresh, select the edit button and expand the "code" section. Then you can insert "refresh" and "refreshType" into the "options" section inside the json of your data source. I've included an example below: { "type": "ds.search", "options": { "query": "| tstats count where index=*", "queryParameters": { "earliest": "-60m@m", "latest": "@m" }, "refresh": "5s", "refreshType": "delay" }, "name": "pulsarRateOut" }  Unfortunately I'm unaware of a way to refresh the entire dashboard in one setting. There's some more information about this here:  https://docs.splunk.com/Documentation/Splunk/8.2.2/DashStudio/dsOpt#refreshType_and_refresh_options_example Hope this helps! ... View more