This is a known issue;  Splunk is currently working on improving this issue, no ETA, but expect to see improvements in a version > 10.0.  ... View more

thanks a lot, that was the solution !  ... View more

Awesome! ... View more

I think @gcusello 's answer is the best scalable approach. If it's something quick and small, you could do something like this to keep it all in the SPL without needing a lookup:   index=brandprotection name IN (ali, ahmad, elias, moayad) | stats count BY name | append [| makeresults | eval name="ali, ahmad, elias, moayad" | eval name=split(name, ", ") | mvexpand name | eval count=0 | fields name count] | stats sum(count) AS count BY name   ... View more

This seems to be an limitation on the Microsoft end: https://learn.microsoft.com/en-us/previous-versions/office/developer/o365-enterprise-developers/jj984335(v=office.15)?redirectedfrom=MSDN#data-granularity-persistence-and-availability   The `delay_throttle` option in the input can be used to control it, but the docs seem to say that events can be delayed by 24-hours in the Microsoft end, so that seems to be why the default is 24-hours. ... View more

Hi! I think you are referring to panels that can fold in the dashboard. I believe this has already been answered here: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-feature-expand-or-collapse-panel-in-dashboard-using/m-p/507211/highlight/true#M33722  ... View more