This is the best that you can do: | makeresults | eval raw="time=1/1/2018,Concepto=prueba01,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba01,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba01,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba01,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba02,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba02,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba02,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba02,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba03,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba03,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba03,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba03,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba04,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba04,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba04,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba04,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba05,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba05,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba05,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba05,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba06,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba06,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba06,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba06,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba07,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba07,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba07,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba07,Value1=45,Value2=21,Value3=25,Value4=67 time=1/1/2018,Concepto=prueba08,Value1=45,Value2=21,Value3=25,Value4=67 time=2/1/2018,Concepto=prueba08,Value1=45,Value2=21,Value3=25,Value4=67 time=3/1/2018,Concepto=prueba08,Value1=45,Value2=21,Value3=25,Value4=67 time=4/1/2018,Concepto=prueba08,Value1=45,Value2=21,Value3=25,Value4=67" | makemv raw | mvexpand raw | rename raw AS _raw | kv | eval _time = strptime(time, "%m/%d/%Y") | fields - time | rename COMMENT AS "Everything above generates sample event data; everything below is your solution." | bin _time span=1mon | stats sum(Val*) AS Val* BY Concepto _time | addtotals Value* fieldname="ValueTotal" | eval time = strftime(_time, "%b") | sort 0 - _time | streamstats dc(_time) AS spaces_count | eval spaces_count = spaces_count - 1 | eval initialLength = len(time) | eval time = " " . time | eval paddedLength = len(time) | eval time = substr(time, paddedLength - initialLength - spaces_count + 1) | foreach Value* [ eval {time}:<<FIELD>> = <<FIELD>> ] | fields - time Value* | stats values(*) AS * BY Concepto ... View more

@Carolina - Please feel free to repeat a section of your question in Spanish. There are many Spanish speakers in the Splunk community, and we'd be happy to help. I'm going to give my advice in English, since half of it has to be in English anyway due to the keywords involved. When you say "only the last event", I assume that you have accomplished that requirement with the head 1 in your code. Here are the steps to make your desired dash - 1) Use your above query as a "base" query to create the underlying table for each of your two panels. Please verify that the below code produces a table with both R and N estado values in it. index=open source=appskp | head 1 | rename COMMENT as "turn the individual fields into multivalue fields" | makemv delim="," claves | makemv delim="," nombre | makemv delim="," estado | rename COMMENT as "zip them together into a single field, then split up the records" | eval myzip=mvzip(mvzip(claves,nombre,"!!!!"),estado,"!!!!") | mvexpand myzip | rename COMMENT as "unpack the fields again and make a table" | rex field=myzip "(?<claves>\d+)!!!!(?<nombre>.+?)!!!!(?<estado>.+?)) | table claves nombre estado 2) For each of your gauges, use the base query, and a postprocessing filter for the received - or -not-received state. | where estado="R" or | where estado="N" 3) Create two more panels, one to show the data table for each. Use the depends= keyword with a distinct token for each one, to hide them until they are desired. 4) Set the click for each of your shown gauges to set the depends token for its own table and to unset the depends token for the other table. ... View more

Yes it is Use eval field_count=mvcount(Respuesta) to count the number of events in a multivalued field, and then filter them out with where field_count==1 ... View more

In the <done> section of the first panel you can set global tokens like this; <done> <set token="myEarliest">$job.earliestTime$</set> <set token="myLatest">$job.latestTime$</set> </done> ... View more

This is due to mix being a partial token (like part of a whole word). See slide 29 of this presentation by Martin Mueller: https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf. To illustrate, try index=search sourcetype=datos.log | search mix=818 . ... View more