thank you for your answer ,I tried the search you shared is does not show the IP  address of the hosts , also the number does not match the number showing in the forwarder management dashboard  ... View more

hello thank you for answering  here is the panel search when it gets excused when  I delete the pipeline added by splunk and run the search again the issue  will be resolved   | pivot Traffic All_Traffic FILTER zone is "User  Zone" | count(zone) AS zone_count SPLITROW zone AS zone TOP 100 count(zone) ROWSUMMARY 0 COLSUMMARY 0 SHOWOTHER 1   I am taking this approach because I want to build a dashboard from a datamodel and I want it to be dynamic so the user can choose from the dirlldown the zone that the dashboard base search will take the user input and pass it to the panels searches that would give results for the zone chosen by the user  ... View more