Assuming msgType extracts values such as SAP and TMD, try something like this | rex field=message "MessageTemplate\\\":\\\"(?<msgType>[^\\\"]+)" | spath | search SAP OR TMD |timechart count by msgType ... View more

Try this | rex field=message "reqPath\\\":\\\".*/(?<reqPath>\w+)" where the .* is a greedy capture up to the final / character ... View more

Your admins likely have the app your dashboard is in locked down. If you don't have write access to the app, then you won't be able to edit permissions to share within the context of the app.  Private objects while tied to the app aren't actually in the app, they're in your private directory on the backend. ... View more