@sundareshr - Sure, here is the whole dashboard (slightly modified, to protect the innocent! 😉 ).
I really appreciate the quick responses, and I hope you can help us get to a good pattern we can follow with other dashboards we are working to create.
-Thanks!
<form>
<label>Usage</label>
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="tenantid_tok">
<label>Domain</label>
<default>All</default>
<choice value="">All</choice>
</input>
<input type="time" token="date_tok" searchWhenChanged="true">
<label>Time Range</label>
<default>
<earliest>-1mon@d</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<search id="login_checkpoints">
<query>index=myIndex sourcetype=mySource $tenantid_tok$ NOT CrashReport NOT ErrorReport ("TYPE1" OR "TYPE2")
| `expand_checkpoints`
| fields - _raw
| spath input=checkPoint output=eventName path=EventName
| where match(eventName,"TYPE1") or match(eventName,"TYPE2")
| spath input=checkPoint output=userId path=UserId
| spath input=checkPoint output=tenantId path=TenantId
| spath input=checkPoint output=eventTime path=EventTime
| spath input=checkPoint output=metaData path=MetaData
| spath input=metaData output=userType path=USER_TYPE
| spath input=checkPoint output=deviceId path=DeviceId
| spath input=checkPoint output=deviceModel path=DeviceModel
| spath input=checkPoint output=deviceOS path=DeviceOS
| spath input=checkPoint output=appVersion path=Version
| eval deviceType=if(like(deviceOS,"Android%"),"Android","iOS")
| eval fullUserName=userId+"@"+tenantId
| fields - checkPoint
| fields eventName,userId,tenantId,eventTime,metaData,userType,deviceId,deviceModel,deviceOS,appVersion,deviceType,fullUserName</query>
<earliest>$date_tok.earliest$</earliest>
<latest>$date_tok.latest$</latest>
</search>
<row>
<panel>
<title>Users</title>
<single>
<title>Total</title>
<search base="login_checkpoints">
<query>chart dc(fullUserName)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="trendInterval">auto</option>
</single>
</panel>
<panel>
<title>Devices</title>
<single>
<title>Total</title>
<search base="login_checkpoints">
<query>dedup deviceId
| chart count(deviceId)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
</single>
</panel>
</row>
<row>
<panel>
<single>
<search base="login_checkpoints">
<query>dedup fullUserName
| where match(userType,"INTERNAL")
| chart count(fullUserName)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="trendInterval">auto</option>
<option name="afterLabel">Internal</option>
</single>
<single>
<search base="login_checkpoints">
<query>dedup fullUserName
| where match(userType,"EXTERNAL")
| chart count(fullUserName)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="trendInterval">auto</option>
<option name="beforeLabel">External</option>
</single>
</panel>
<panel>
<single>
<search base="login_checkpoints">
<query>dedup deviceId
| where match(deviceType,"iOS")
| chart count(deviceId)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="trendInterval">auto</option>
<option name="afterLabel">iOS</option>
</single>
<single>
<search base="login_checkpoints">
<query>dedup deviceId
| where match(deviceType,"Android")
| chart count(deviceId)</query>
</search>
<option name="drilldown">none</option>
<option name="colorBy">value</option>
<option name="colorMode">none</option>
<option name="numberPrecision">0</option>
<option name="showSparkline">1</option>
<option name="showTrendIndicator">1</option>
<option name="trendColorInterpretation">standard</option>
<option name="trendDisplayMode">absolute</option>
<option name="useColors">0</option>
<option name="useThousandSeparators">1</option>
<option name="linkView">search</option>
<option name="rangeColors">["0x65a637","0x6db7c6","0xf7bc38","0xf58f39","0xd93f3c"]</option>
<option name="rangeValues">[0,30,70,100]</option>
<option name="trendInterval">auto</option>
<option name="beforeLabel">Android</option>
</single>
</panel>
</row>
<row>
<panel>
<title>Unique User Logins</title>
<chart>
<search base="login_checkpoints">
<query>timechart dc(fullUserName) as "Unique Users"</query>
</search>
<option name="charting.chart">line</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">none</option>
<option name="height">325</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Application Versions</title>
<chart>
<search base="login_checkpoints">
<query>dedup deviceId
| eval versionAndDevice=appVersion+" ("+deviceType+")"
| chart count by versionAndDevice useother=false</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.001</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="height">375</option>
</chart>
</panel>
<panel>
<title>Device OS</title>
<chart>
<search base="login_checkpoints">
<query>dedup deviceId
| chart count by deviceOS useother=false</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.001</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="height">375</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Internal Devices</title>
<table>
<search base="login_checkpoints">
<query>where match(userType,"INTERNAL")
| dedup deviceId
| chart count by deviceModel useother=false
| sort - count</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">15</option>
</table>
</panel>
<panel>
<title>External Devices</title>
<table>
<search base="login_checkpoints">
<query>where match(userType,"EXTERNAL")
| dedup deviceId
| chart count by deviceModel useother=false
| sort - count</query>
</search>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">15</option>
</table>
</panel>
</row>
</form>
... View more