Hi All; I want my table to display only fields that have values for at least 1 row AND have the fields be in the order that I specify. Splunk always puts the fields in Alphabetical Order, which is not what I want. For example, here's my code: ...| chart count over global_stand_name by global_order_status_display This gives me what i want by not including NULL values, but the ordering of the fields is off. Thus I do this: | table Stand Created Bumped Assigned Completed which gives me my data in the correct order but it then displays fields that might have no values in it. Thus my table will look like this: Stand, Created, Bumped, Assigned, Completed stand1, 5, , , 10 stand2, 6, , 12, 11 stand3, 7, , 2, 23 In this case there are no values for Bumped, so I'd like the field Bumped to not be displayed, but still have the order be Stand, Created, Assigned, Completed Is this possible? Thanks, Tyler ... View more

HI All; I have and issue dealing with a dynamic prompt: I have 3 prompts. The first prompt selects the day and the next 2 prompts give a start and end timestamp for that day. The prompts works well at first, but when i switch the first prompt from the default date to another date, the time stamps associated with the first date stay as the values for the other 2 prompts, which produce zero results because those time stamps are for another day. Is there a way that I can make those 2 prompts just reset to the default value, which is the selectFirstChoice? Here's my code below: <form refresh="9999999360"> <label>Venue F&amp;B Dashboard</label> <fieldset submitButton="false"> <input type="dropdown" token="date" searchWhenChanged="true"> <label>Select a Date:</label> <search> <query>|inputlookup lookup_mobile_events_metadata.csv |stats count| eval time="Today"|eval row=0|append[| `macro_Ndays_timepickernew(10)`| streamstats count as row|eval row=row*(-1)]|eval next_day=row+1</query> <earliest>-24h</earliest> <latest>now</latest> </search> <fieldForLabel>time</fieldForLabel> <fieldForValue>row</fieldForValue> <default>0</default> <change> <set token="date_after">$row.next_day$</set> </change> </input> <input type="dropdown" token="earliest_timestamp" searchWhenChanged="true"> <label>From:</label> <search> <query>| `Macro_To_and_From_Timepicker_To($date$,$date_after$,starttime)`</query> <earliest>0</earliest> </search> <fieldForLabel>starthuman</fieldForLabel> <fieldForValue>starttime</fieldForValue> <selectFirstChoice>true</selectFirstChoice> </input> <input type="dropdown" token="latest_timestamp" searchWhenChanged="true"> <label>To:</label> <search> <query>| `Macro_To_and_From_Timepicker_To($date$,$date_after$,endtime)`</query> <earliest>0</earliest> </search> <fieldForLabel>endhuman</fieldForLabel> <fieldForValue>endtime</fieldForValue> <selectFirstChoice>true</selectFirstChoice> where macro definitions are below: [macro_Ndays_timepicker(1)] args = days definition = gentimes start=-$days$ end=0|eval time=strftime(starttime,"%Y %B %d")|sort - starttime|rename starttime as dateadded_epoch iseval = 0 [Macro_To_and_From_Timepicker_To(3)] args = start,end,startorendtime definition = gentimes start=$start$ end=$end$ increment=30m| sort + starttime|eval display_time=strftime($startorendtime$,"%H:%M") iseval = 0 here's pics of the issue: The prompts appear all fine for today June 19th, But when I change from the 19th to the 16th in the first prompt, the next 2 prompts don't update the chosen value and instead keep the selected Epoch timestamp they had for the 19th. Although as you can see, in the back end the choices did change, so the user would then just have to select an appropriate time for the selected date. Any suggestions? Thanks, Tyler ... View more

Hi All; I have 2 types of users that will be coming to our dashboard. The first should be able to see all the different companies that belong to the organization. The next would be a user that could only see info for a single company in the organization. The ability to see the data depending on the users has been handled in our Role definitions, which is working great. But my problem/question arises with the prompt on the dashboard which allows the user to select what company they would like to view. This prompt basically is just a list of all the companies the user has access to see, so to first user it is all the companies and for the second user it is just their 1 company. Thus the prompt really is only prominent for the first user and not the second, since the second only has 1 choice. Is there a way to make the prompt only appear when the first user logs in and remain hidden when the second user logs in? Thanks, Tyler ... View more