The way I have done something similar is possibly over-elaborate but I started with a lookup, as you mentioned, then populate the Id column from this lookup. In order to update the lookup, I have another panel where the key (email in this case) and new ID value can be added - I added checkbox to this for the use to confirm that the update was correct. Then on change for the checkbox, set tokens for a third panel to use to actually update the lookup with outputlookup. This third panel is hidden using the depends attribute. The third panel also resets the checkbox in the second panel so I can detect a new update, and it sets a token used in the first panel so that the panel gets refreshed. I have some other pieces set up so only certain users can update the lookup although to be fair these could be overridden reasonably easily if someone was determined enough. ... View more

Thanks a ton. This worked. ... View more

There appear to be a couple of typos(?) in your query (order of fields in mvzip don't match rex extraction, table field name should be success not suc, device is not listed in table so count should possibly be MODEL), but aside from this, if the issue is to do with mvexpand limitations, have a look at this solution to see if it helps https://community.splunk.com/t5/Splunk-Enterprise/Alternatives-to-using-MVExpand-running-into-limitations/m-p/541523#M5051  ... View more

Hi @nikitha15 - just ran into the exact same problem. Let me show you what I did just for max using a search that anyone can run on their own Splunk Enterprise or Splunk Cloud deployment.  Main search is like so:  index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart span=h count by sourcetype Annotation search is like so:  index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart span=h count by sourcetype | eval total = splunk_web_access + splunkd_access | stats max(total) | rename max(total) as Max | map search="search index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart span=h count by sourcetype | eval total = splunk_web_access + splunkd_access | search total=$Max$" | eval annotation_label = "Max interactions occurred at " + strftime(_time, "%H:%M:%S") + " - total of " + total + " interactions." | fields _time, annotation_label, total I used  map to pull out just the timespan associated with the max number of events - someone better at SPL could probably find a better approach. Note that in SimpleXML dashboards you have to use $$ around the map replacement token instead of $ in the search bar.  To show the whole dashboard:  <dashboard> <label>Test for nikitha15</label> <row> <panel> <chart> <search> <query> index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart count by sourcetype span=h </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <search type="annotation"> <query> index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart span=h count by sourcetype | eval total = splunk_web_access + splunkd_access | stats max(total) | rename max(total) as Max | map search="search index = _internal sourcetype IN (splunk_web_access, splunkd_access) | timechart span=h count by sourcetype | eval total = splunk_web_access + splunkd_access | search total=$$Max$$" | eval annotation_label = "Max interactions occurred at " + strftime(_time, "%H:%M:%S") + " - total of " + total + " interactions." | fields _time, annotation_label, total </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </chart> </panel> </row> </dashboard>   Let me know if that's not quite answering your question.  ... View more

Hi @nikitha15 , You accepted this answer during the closing period, so your acceptance wasn'r recorded, could you accept it again? Ciao. Giuseppe ... View more

    Index= main sourcetype= timeline | eval dates=beginning_date."-".ending_date | stats count by dates, target | xyseries dates target count   https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval You can fix the rest.   ... View more

@nikitha15 Can you please check how many events you getting with the search?? index=main (sourcetype="sourcetype1" OR sourcetype="sourcetype2") I doubt the limit of search results. https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Limitsconf#.5Bsearchresults.5D ... View more