I would recommend looking into autoregress . You could also look into streamstats or eventstats This may be helpful. https://answers.splunk.com/answers/310189/is-it-possible-to-autoregress-by-unique-site.html ... View more

The answer from @richgalloway would work too. (Would still be good to check the managed jobs though to see if it matters) ... View more

To check if the search actually runs even when it is hidden, you should go to your job history and see if the search has ran even though the token didn't exist and the panel didn't show. If the search does run (I don't think it does, but am not 100% sure) you could put a token value in the search and unset on start so it doesn't run. The search will definitely not run if the token in the search does not exist. Then when you want the search to run, you can make a condition to give the token a value (it could even just be a "" or *) so that the search can run since the token will then exist. I would check your managed jobs first to see if the search runs even though the panel is hidden. ... View more

Since the alert creates a job, the below two links may help. This uses | rest /services/search/jobs https://answers.splunk.com/answers/83436/dashboard-of-jobs.html If it is a saved search, this may be better to look at This uses | loadjob savedsearch="user:app:my_search" https://answers.splunk.com/answers/260035/what-can-we-use-to-replace-loadjob-based-dashboard.html ... View more

If Count is actually a field, the above should work. If not, try this. your_search | stats values(Text) as Text, count as Count by Name | table Name, Text, Count | eval Text=mvjoin(Text,",") the eval Text mvjoin can be added if you want it to be a comma separated list ... View more