I think this is an instance where "optimizing" is not optimal.  While a clever person such as yourself may be able to craft an amazing regular expression that is the equivalent of the many regexes your former coworker used, that doesn't make it better.  As you're discovering, such a regex may require many more steps and more resources than the many regexes it replaces.  Consider also the person who will replace you and have to maintain your creation.  Will he or she be able to understand it enough to adapt it to a changing data source?  In six months time, will *you* be able to understand it enough to adapt it to a changing data source? ... View more

Well, not right now. We have made some changes and that has prevented the panels from showing again. However i was curious if there was any mention of this event type in xml or not. Is there any event for checking if the panel is awaiting input? ... View more

welcome!!! ... View more

Awesome examples, thanks! ... View more

I'm not sure why you would have four searches to get Country, Year, Month and Day to populate dropdowns. That's really only two fields, and how you break them up. I'm also not sure why that search would be particularly time consuming. If Country is an indexed field, and the relevant Date field is an indexed field, then you can have an initial search using tstats to create records with Country and Date, then use post-processing to split out the pieces | tstats count as count0 WHERE index=foo BY Country span=1d This should quickly give you a record for each Country for each Date there is data for that Country, assuming the event's _time contains the Date value in question. On the other hand, if the required Date is in an indexed field called whateverDate, you would do something like this. | tstats count as count0 WHERE index=foo BY Country, whateverDate ... View more