The use of bin and dedup together means only one event in each minute will be returned.  That's not going to give the desired results.  Try stats, instead. your search | stats count by _time That will give the number of events for each minute.   To get the number of distinct users for each minute, try your search | stats dc(user) as users by _time   ... View more

The only changes one can make to that display is offered in the drop-down at the top of the results: raw, list, or table. ... View more

uri is the field in the example search partial_uri is the field I created that is a shortened form of uri The <fields> statement is one that restricts the visible fields in the table to only the date and the partial uri The $row.uri$ is how the clicked drilldown accesses the (non visible) uri field in the table and assigns it to the uri token Tokens are of the form $name$, so $uri$ is a token called uri and it is assigned the contents of the uri field from the search in the drilldown section of the dashboard when it does the set token statement. Have a read of this, as it will make things clearer (hopefully :)) https://docs.splunk.com/Documentation/Splunk/8.0.4/Viz/PanelreferenceforSimplifiedXML       ... View more

The timechart command automatically fills in missing dates.  You can always remove them with ... | where NOT TB=0   ... View more

Hi Check this link https://dev.splunk.com/enterprise/docs/developapps/addnavsplunkapp/ ... View more

hi @nickhillscpl i solved it. Thanks very much! ... View more

Hi, @woodcock Thanks for help! i think we understood wrong eachother. i want to explain again... We have "audit_log" from our software in splunk and the data are updated every second. There are sometimes log-in error if somebody give wrong password or when the server has problem. and we set the email-alert when somebody have log-in error. BUT we want to also include the last audit_log line in email-alert. My question was whether it is possible or not... Do you have any idea? Thanks ... View more