Hi all!  I've populated a table dynamically based on a drop down a user can manipulate using...    | inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check]   Additionally I can extrapolate each column into a dropdown using...   | inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | eval value= [| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | transpose | fields column | streamstats count(column) as order | where order = 2 | return $column] | fields value | table value | stats values(value) as value | mvexpand value   by varying order = #  The issue I'm running into now is pairing the drop down,  the drop down with a set token of "filter1" Run within    | inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | search [| inputlookup [| rest /services/saved/searches | fields title | search title=*$userInput$*.c | eval check=replace(title,"\.c",".csv") | return $check] | head 1 | table * | transpose | head 1 | return $column] = $filter1$     The token is not functioning and will not populate in the query, while other tokens will. I've additionally confirmed the query works, just not when used with tokens within a dashboard.  To summarize, the overall goal is to provide 4-6 drop downs and a table. Based on the initial user request, this table would populate with data, and each drop down would then be able to further filter data,  with the field names and values all varying. If something isn't clear please ask and I'd be glad to provide, been banging my head against this one for awhile lol. ... View more

Following a super helpful thread here https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html But I've ran into an issue where when I start to use stats, I always drop one of my indexes, is it possible to use stats and still maintain both indexes, or at least merge the data prior to losing one of them? (index=Index1 sourcetype=Type1) OR (index=Index2) | fields field1 field 2 mac_address dest_mac | eval mac_address=replace(mac_address,"\W","") | eval mac_address=lower(mac_address) | rex field=dest_nt_host "(?[^.]+)." | eval dest_nt_host=lower(dest_nt_host) | eval dest_mac=lower(dest_mac) | stats values(index) as index values(field1) as field1 values(field2) as field 2 values(index) as index values(mac_address) by dest_mac | table dest_mac mac_address field 1 field 2 index essentially whatever state with the BY-clause is the index that's kept, but ideally I'd like to match on dest_mac and mac_address, while pulling field 1 from index 1, and field 2 from index 2 Without the by clause, my data essentially is appending without append, looking like... field 1 dest_mac index 1 field 2 mac_Address index 2 Thanks in advanced! ... View more