I agree with this suggestion.  Going back to your original visual there is no current method to get items grouped the way you suggested.  Using a trellis gives you the bar graph that you want and you can break out individual items into separate graphs all on one dashboard/report sourced from a single search. ... View more

@chookp add the following to your dropdown change event handler to set/unset showPanel2 token and use the token as depends attribute for Panel 2 <panel> as well as <search> <change> <condition label="All"> <unset token="showPanel2"></unset> </condition> <condition> <set token="showPanel2">true</set> </condition> </change>   <panel depends="$showPanel2$"> <table> <title>Panel 2</title> <search depends="$showPanel2$"> Following is a run anywhere dashboard example based on the details provided for you to try and confirm! <form> <label>Hide Show panel based on Dropdown value</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="dropdown" token="ASSET_NAME" searchWhenChanged="true"> <label>ASSET_NAME</label> <choice value="*">All</choice> <choice value="a">Alpha</choice> <choice value="b">Beta</choice> <choice value="c">Charlie</choice> <default>*</default> <change> <condition label="All"> <unset token="showPanel2"></unset> </condition> <condition> <set token="showPanel2">true</set> </condition> </change> </input> </panel> <panel> <!-- EMPTY PANEL TO ALIGN INPUT PANEL WITH PANEL1 and PANEL2 below --> </panel> </row> <row> <panel> <table> <title>Panel 1</title> <search> <query>| makeresults | eval selectedValue="$ASSET_NAME$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel depends="$showPanel2$"> <table> <title>Panel 2</title> <search depends="$showPanel2$"> <query>| makeresults | eval showPanel2="$showPanel2$"</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form>   ... View more

i am also finding a way to remove the result which my duration are 0 and values only stop ... View more

Have you try my query and see the result? I created the query from your result. I don't know what you do not understand it. Please see the reference and try line by line. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults ... View more

hi @chookp use this | where NOT match(DATE,strftime(_time,"%d/%m/%Y")) istead of | where DATE!=strftime(_time,"%d/%m/%Y") ... View more

thanks everything works nicely now 🙂 ... View more

CREATEDATETIME is format "%m/%d/%Y %T %p" strptime makes epoch time to duration. eventstats range aggregates duration between run and stop tostring change duration to readable. ... View more