try this   index=pan* dvc_name="*" sourcetype="pan:traffic" OR sourcetype="pan:system" | stats count by dvc_name | where count=0   in the alert condition select if number of results>0 ... View more

Try using this if you have a column named TransactionId and trying to store it in a token when clicked   <init> <set token="TransactionId">$row.TransactionId$</set> </init>    ... View more