Here is my current code below - <dashboard> <label>Dashboard Title</label> <description/> <row> <panel> <chart> <title>Title1</title> <searchString>Search1</searchString> <earliestTime>@d</earliestTime> <latestTime>now</latestTime> <fields>["host","source","sourcetype"]</fields> </chart> </panel> <panel> <single> <title>Title2</title> <searchString>Search2</searchString> <earliestTime>@d</earliestTime> <latestTime>now</latestTime> <option name="drilldown">none</option> <option name="afterLabel">MINUTES</option> <option name="linkView">search</option> <option name="refresh.auto.interval">64</option> </single> </panel> </row> </dashboard> ... View more

I know I must be missing something simple and have searched here trying multiple things but still can't get this to work. I get the results just fine and they come via email, but I need a blank line between each of the results in order to make easier for the end user to view. Can someone please help? This is basically what I have right now: $SearchText$ | rex mode=sed "s/\n/\n\n/g" | rex mode=sed "s/\x1/ /g" | sort _raw | table _raw | sendemail Thanks! ... View more

For instance, I have a search where I want to query for a value that would set that value to orderid such as: sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P \d+)\D" | search "|11= |" | fields orderid and this query is able to take the error message and find what follows "11=" and set its to a value called orderid, but I then want to take that value I've set as orderid and have it query from a second source all as part of the same query. I have tried adding this at the end in order to search the second source: map search="search sourcetype="Source2" $orderid$" So my entire query looks like this, I thought this would work but doesnt seem to be properly passing the value of orderid to query from the second source: sourcetype="Source1" | search ErrorMessage | rex ".[1][1]=(?P \d+)\D" | search "|11= |" | fields orderid | map search="search sourcetype="Source2" $orderid$" Please help answer or offer any insight you may have, I may be doing this entirely wrong! ... View more