I have testing dashboard like below, where user can specify the search time range,         <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <label>Select display time range</label> <default> <earliest>-5d</earliest> <latest>now</latest> </default> </input> </fieldset> ... ... ... <panel> <title>Test Table</title> <event> <search> <query>eventtype="test_eventtype" | fields testColumnA, testColumnB, testColumnC | table testColumnA, testColumnB, testColumnC, eventtype | sort </query> <earliest>$earliest$</earliest> <latest>$latest$</latest> <refresh>30m</refresh> <refreshType>delay</refreshType> </search> <fields>testColumnA, testColumnB, testColumnC</fields> <option name="count">10</option> <option name="rowNumbers">1</option> <option name="type">table</option> </event> </panel>           the panel display and time range selection work as expected.  But whenever i click on the column value link in the panel to jump to search page, it fails with the "Invalid earliest_time.". For the URL: https://test/en-US/search?q=eventtype%3D%22test_eventtype%22%......&earliest=%24earliest%24&latest=%24latest%24 Which indicates the earliest and latest time is not using the actual values but '$earliest$', '$latest$'.   So, what is the right way make this working? ... View more

For example, I'm creating a dashboard with two timecharts like below: eventtype="watchlist_result" | timechart span=1h limit=0 first(nDevices) by name | fillnull value=0 eventtype="watchlist_result" | timechart span=1h limit=0 first(nActivities) by name | fillnull value=0 And in the dashboard I configure using 'Trellis' so I get chart for each 'name'... One thing that is cumbersome is that I end up with two panels, and if user wants to look at the device and activity count for the same name , they have to scroll on both panels... However, I would like to bundle the two timecharts (since they are split by the same field 'name') into one panel, so that charts with same name are presented together and user just needs to scroll once, [Edit] To clarify further, the nDevices , nActivities and name are fields extracted from the event, Since the charts are all split by the same field name , i would like to have a way to have the device/activity chart from the same name shown together like a pair in trellis,,, something look like below: ... View more