Hello,   I am trying to add a background cover for the panels within a dashboard.   I have attached a photo of what we currently have and then a photo example of what I am trying to do.   Including is the source code for these panel sections.   <row> <panel> <title>DoS Protection Count and Distribution Aggregate - ALL DATACENTER FIREWALLS</title> <table> <title>DoS Protection Count and Distribution - ALL DATACENTER FIREWALLS</title> <search> <query>index=pan_logs threat_category=flood dvc="FD0*.*" rule="* DoS Protection" vendor_action="random-drop" OR vendor_action="drop" action!=unknown | stats sparkline sum(repeat_count) by vsys_name dvc dest_ip action | sort by sum(repeat_count) desc limit=10 | rename sparkline AS "Distribution", sum(repeat_count) AS "Count", dest_ip AS "Destination", vsys_name AS "Virtual System", dvc AS "Device", action AS "Action" | table Device "Virtual System" Action Count Destination Distribution</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>2m</refresh> <refreshType>delay</refreshType> </search> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <title>ALL DATACENTERS | Resources Unavailable</title> <chart> <title>ALL DATACENTERS | Resources Unavailable</title> <search> <query>index=pan_logs dvc="*" session_end_reason="resources-unavailable" | timechart span=5h count by dvc</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <refresh>2m</refresh> <refreshType>delay</refreshType> </search> <option name="charting.chart">column</option> <option name="charting.drilldown">none</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> <row>   ... View more

Hello, I am trying to setup a search where we look for single source IP's hitting multiple destination IP's on our firewall. 1. When I do a search, I get TONS of results for destinations, but I want to limit the destination results to only show a few sample set. 2. I also have results showing up which only show one destination IP, which we do not want.   The search I am using as an example is    index=pan_logs eventtype=pan_traffic dvc="FD0*.*" action=allow OR action=allowed OR action=alert app=sip OR dest_port=5060 OR dest_port=5061 AND src_ip!=10.0.0.0/8 AND src_ip!=172.16.0.0/12 AND src_ip!=192.168.0.0/16  | stats values(rule) values(dest_ip) values(dest_port) count by src_ip vendor_action app dvc vsys | sort bt count desc limit=10 | sort dest_ip | where count > 500 | fields src_ip dvc vsys values(rule) app values(dest_ip) values(dest_port) vendor_action count | rename src_ip AS "Source IP", vendor_action AS "Action", values(rule) AS "Firewall Rule", values(dest_ip) AS "Target IP", values(dest_port) AS "Destination Port", count AS "Total Count", dvc AS "Device", app AS "Application" | head 20     Example search result ... View more