That worked for me somesoni2.   Thanks for your help! ... View more

This is the search syntax: <label>Message/Note Search</label> <fieldset autoRun="false" submitButton="true"> <input type="time" token="field1"> <label>Time</label> <default> <earliest>-4h@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="sourcetype" searchWhenChanged="false"> <label>Sourcetype</label> <choice value="*">All</choice> <default>*</default> <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype"> <![CDATA[|metadata type=sourcetypes index=netfw | stats count by sourcetype]]> </populatingSearch> </input> <input type="text" token="*"> <label>Message/Note</label> </input> </fieldset> <row> <panel> <table> <title>Source IP Search Results</title> <search> <query>index=scfw sourcetype="$sourcetype$" (msg="$*$" OR note="$*$")</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> ... View more

Yes I am using the pivot report and trying to add a filter. ... View more

Thanks, bowesmana,   I am new to Splunk I am trying to figure out the query for my search I am using a pivot search and when I put  ip=$ip_text$ It tells me Error in 'PivotProcessor': Error in 'PivotCell': The dataset 'RootObject' has no field 'IP='.  I am wondering if I am doing the search wrong. ... View more