Absolutely. It sounds like a Lister module would work very well. I'd suggest looking at the UI examples app from splunkbase. There are a wide variety of examples of how to use it. But in short: You'll need to use Advanced XML. (Switch to advanced XML: http://answers.splunk.com/questions/1/how-can-i-convert-simple-view-xml-to-advanced-xml . Fix issue with switching to advanced XML, if you get the "unicode" object has no attribute "get" error -- I usually / always get this: http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get/3665#3665 .) You can add a Lister module: http://www.splunk.com/base/Documentation/latest/Developer/HowToUseListers Your lister module can be based on a search for app2audit Instance=USCASF | stats count by Period | sort - Period You could even add the ability to specify either the Instance, or the Period, and then get a dropdown of Instances / Periods, depending on your selection. (See the UI Examples app for an example of how this works: http://splunkbase.splunk.com/apps/All/4.x/Add-On/app:UI+Examples .) As an aside: You'll likely want to set up a summary index for however you determine your available Periods, as this will be an additional search. If you need to go through 300,000 records to get a list of the Periods, your users will have to wait for that to complete before they can even select the search. Even if you only have to go through 10,000, the slowdown will be noticeable. ( http://www.splunk.com/view/SP-CAAACZW ) ... View more