You haven't provided description/sample of your data so we don't know - for example - how many events you can have per each contextId but I suppose you're simply looking for something like index="log-3258-prod-c" | stats values(user_name) as user_name  values(Flow) as Flow [... more aggregations here ...] by contextId If you want to list all fields, you can simply shorthand the stats to | stats values(*) as * by contextId ... View more

Correct - just one of the reasons I don't use Studio for serious dashboards (yet) ... View more

Ideally when you have a newline character in your CSV file. Open that CSV file in a text editor (notepad, notepad++, etc), and your line should read something like: Autosys,01-2022,"There are many Autosys failures this month as compared to previous.\n Main reason of failure is Server reboot.\n All host issues have been resolved and numbers would do down this month" \n represents a newline character.   (Though, I'm not sure which component of Splunk Dashboard Studio treats \n as a newline character and which treats it as text.) ... View more

All you need to do is to change the 'where' line to this | fillnull Header value="Others" | where match(Alert_Header, Inclusion) AND (Exclusion="NONE" OR !match(Alert_Header, Exclusion)) OR match(Header, "^Others$") This is saying  make all Header values that are null, the word "Others" Add an extra test to include the row is that header is exactly Others The reason why it's excluded is that criteria is null for the non matched mappings, hence the expanded variables Inclusion/Exclusion/Header are then null, so for this specific case, you then fix it up at the end. ... View more

Sorry My Bad.....Its works Superbly !!! Thanks for your quick answer !!! Really appreciated !! ... View more