You need to pass the "earliest_time" and "latest_time" parameters in your POST request to do so, just like you did for "search". You can find the specifications of these parameters in the "Request" table of the REST API reference documentation I linked earlier. ... View more

I think I figured it out. Seems that where you stick the dedup is important. So posting this works: index="Firewall" AND host= AND "PHASE 2 COMPLETED" | dedup s2s_VendorPeers | stats count(s2s_VendorPeers) by s2s_VendorPeers, _time | convert ctime(_time) as time | fields time, s2s_VendorPeers Where this doesn't: index="Firewall" AND host= AND "PHASE 2 COMPLETED" | stats count(s2s_VendorPeers) by s2s_VendorPeers, _time | convert ctime(_time) as time | fields time, s2s_VendorPeers | dedup s2s_VendorPeers ... View more

Thank you all for the help! I will try this. ... View more

In regards to your comment, there is a current limitation in Splunk that will let you nest menus only two levels deep. See: http://answers.splunk.com/questions/5311/multi-level-nav-menu-wont-open/5641#5641 ... View more