Hello! Here it is: <form version="1.1" theme="dark">
<label>Hayabusa Overview</label>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="global_time" searchWhenChanged="true">
<label>Global Time Range</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="case_token" searchWhenChanged="true">
<label>Case Selector</label>
<prefix>index=case_</prefix>
<suffix>*</suffix>
<fieldForLabel>case</fieldForLabel>
<fieldForValue>case</fieldForValue>
<search>
<query>| tstats count where index=case_* by index
| rex field=index "\_(?<case>.*?)\_"
| dedup case
| table case</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="multiselect" token="host_token" searchWhenChanged="true">
<label>Host</label>
<choice value="*">All Hosts</choice>
<fieldForLabel>Host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<search>
<query>| tstats count where $case_token$ sourcetype=hayabusa by host
| table host</query>
<earliest>0</earliest>
<latest></latest>
</search>
<initialValue>*</initialValue>
<delimiter>, </delimiter>
<prefix>host IN (</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Top Informational Alerts</title>
<search>
<query>| tstats count where $case_token$ sourcetype=hayabusa $host_token$ Level=info by RuleTitle
| sort -count</query>
<earliest>$global_time.earliest$</earliest>
<latest>$global_time.latest$</latest>
</search>
<option name="drilldown">cell</option>
<format type="color" field="count">
<colorPalette type="list">[#65778A,#65778A,#65778A,#65778A,#65778A]</colorPalette>
<scale type="threshold">0,30,70,100</scale>
</format>
<drilldown>
<set token="form.rule_token">$click.value$</set>
</drilldown>
</table>
</panel>
<panel>
<table>
<title>Top Hosts By Hits</title>
<search>
<query>| tstats count where $case_token$ sourcetype=hayabusa by host
| sort -count</query>
<earliest>$global_time.earliest$</earliest>
<latest>$global_time.latest$</latest>
</search>
<option name="drilldown">cell</option>
<format type="color" field="count">
<colorPalette type="minMidMax" maxColor="#FFFFFF" minColor="#FFFFFF"></colorPalette>
<scale type="minMidMax"></scale>
</format>
<drilldown>
<set token="form.host_token">$click.value$</set>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<title>Hayabusa Hits Overview</title>
<input type="multiselect" token="level_token" searchWhenChanged="true">
<label>Level</label>
<choice value="*">All Levels</choice>
<choice value="info">Info</choice>
<choice value="low">Low</choice>
<choice value="med">Medium</choice>
<choice value="high">High</choice>
<choice value="crit">Critical</choice>
<default>*</default>
<initialValue>*</initialValue>
<prefix>Level IN (</prefix>
<suffix>)</suffix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>, </delimiter>
</input>
<input type="multiselect" token="rule_token" searchWhenChanged="true">
<label>Rule</label>
<choice value="*">All Rules</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>RuleTitle</fieldForLabel>
<fieldForValue>RuleTitle</fieldForValue>
<search>
<query>| tstats count where $case_token$ $host_token$ sourcetype=hayabusa $level_token$ by RuleTitle
| table RuleTitle</query>
<earliest>0</earliest>
<latest></latest>
</search>
<prefix>RuleTitle IN (</prefix>
<suffix>)</suffix>
<delimiter>,</delimiter>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
<input type="text" token="search_token" searchWhenChanged="true">
<label>Search</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="exclude_token" searchWhenChanged="true">
<label>Search (to Exclude)</label>
<default>Default Value to Exclude</default>
<initialValue>Default Value to Exclude</initialValue>
</input>
<input type="multiselect" token="channel_token" searchWhenChanged="true">
<label>Channel</label>
<fieldForLabel>Channel</fieldForLabel>
<fieldForValue>Channel</fieldForValue>
<search>
<query>| tstats count where $case_token$ sourcetype=hayabusa by Channel</query>
<earliest>0</earliest>
<latest></latest>
</search>
<delimiter> </delimiter>
<choice value="*">All Channels</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<html>
<p>For <strong>Search</strong> and <strong>Search to Exclude</strong>, delimit with a comma. For example: <strong>term,search phrase</strong>
</p>
</html>
<event>
<title>$channel_token$</title>
<search>
<query>$case_token$ sourcetype=hayabusa $host_token$ $level_token$ $rule_token$
| fields Timestamp, host, Computer, Level, Channel, RecordID, EventID, Ruletitle, Details</query>
</search>
<fields>Timestamp, host, Computer, Level, Channel, RecordID, EventID, RuleTitle, Details, _time</fields>
<option name="count">50</option>
<option name="refresh.display">progressbar</option>
<option name="table.drilldown">all</option>
<option name="table.sortDirect">asc</option>
<option name="table.wrap">1</option>
<option name="type">table</option>
<drilldown>
<set token="form.channel_token">$click.value$</set>
</drilldown>
</event>
</panel>
</row>
</form>
... View more