Let's assume that your sourcetype is WinEventLog:Security and your lookup file is called EventCode.csv . On your Search Head, navigate to the app that should own the lookup file and then do: Settings -> Lookups -> Lookup table files -> New -> Choose File -> Save Then do: Settings -> Lookups -> Lookup definitions -> New -> Name(="EventCode") -> Lookup file(="EventCode.csv") -> Save Then do: Settings -> Lookups -> Automatic lookups -> New -> Name(=EventCodeAutoLookup) -> Apply to sourcetype named(="WinEventLog:Security") -> Lookup input fields(="EventCode") -> Lookup output fields(="message summary")' -> Save Then do a debug/refresh` on the search head. No all events with a field EventCode and sourcetype of WinEventLog:Security will automatically call lookup to get message summary field values. You can skip the last step and do it manually within the search by adding | lookup EventCode EventCode OUTPUT "message summary" . ... View more

Try this instead: <row> <panel> <title>Top Games</title> <input type="link" token="notUsed" searchWhenChanged="true"> <label></label> <choice value="search1">Search 1</choice> <choice value="search2">Search 2</choice> <choice value="search3">Search 3</choice> <default>search1</default> <change> <condition value="search1"> <set token="search">Search 1 goes here</set> </condition> <condition value="search2"> <set token="search">Search 1 goes here</set> </condition> <condition value="search3"> <set token="search">Search 1 goes here</set> </condition> </change> </input> <chart> <search> <query>$search$</query> </search> <option name="charting.chart">bar</option> <option name="charting.legend.placement">none</option> </chart> </panel> </row> ... View more

hello Martin, thx for your reply I see what you mean, but we want to see the information with buttons instead of a pull down menu, because with pull down , you don't see the list ... View more