Hi you can use this kind of JS file to use as a tooltip. <dashboard script="tooltipnew.js,new.js,tooltipnew2.js,new2.js"> <label>table tooltip</label> <row> <panel> <table id="tblTooltip"> <search> <query>index=_internal sourcetype=splunkd_ui_access |bin span=1d _time |stats count max(bytes) as bytes by method _time |eval reference=count."|".bytes |eval new=method."|".count |fields _time reference new</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table id="tblTooltip2"> <search> <query>index=_internal sourcetype=splunkd_ui_access |bin span=1d _time |stats count max(bytes) as bytes by method _time |eval reference2=count."|".bytes |eval new2=method."|".count |fields _time reference2 new2</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </dashboard> _-------------------------------- new.js ----- require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomTooltipRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'new'; }, render: function($td, cell) { var message = cell.value.split("|")[0]; var tip = cell.value.split("|")[1]; $td.html(_.template('<a href="#" data-toggle="tooltip" data-placement="right" title="<%- tip%>"><%- message%></a>', { tip: tip, message: message })); // This line wires up the Bootstrap tooltip to the cell markup $td.children('[data-toggle="tooltip"]').tooltip(); } }); mvc.Components.get('tblTooltip').getVisualization(function(tableView) { // Register custom cell renderer tableView.table.addCellRenderer(new CustomTooltipRenderer()); // Force the table to re-render tableView.table.render(); }); }); ------- new2.js ------- require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomTooltipRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'new2'; }, render: function($td, cell) { var message = cell.value.split("|")[0]; var tip = cell.value.split("|")[1]; $td.html(_.template('<a href="#" data-toggle="tooltip" data-placement="right" title="<%- tip%>"><%- message%></a>', { tip: tip, message: message })); // This line wires up the Bootstrap tooltip to the cell markup $td.children('[data-toggle="tooltip"]').tooltip(); } }); mvc.Components.get('tblTooltip2').getVisualization(function(tableView) { // Register custom cell renderer tableView.table.addCellRenderer(new CustomTooltipRenderer()); // Force the table to re-render tableView.table.render(); }); }); ------------- tooltipnew.js ------ require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomTooltipRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'reference'; }, render: function($td, cell) { var message = cell.value.split("|")[0]; var tip = cell.value.split("|")[1]; $td.html(_.template('<a href="#" data-toggle="tooltip" data-placement="right" title="<%- tip%>"><%- message%></a>', { tip: tip, message: message })); // This line wires up the Bootstrap tooltip to the cell markup $td.children('[data-toggle="tooltip"]').tooltip(); } }); mvc.Components.get('tblTooltip').getVisualization(function(tableView) { // Register custom cell renderer tableView.table.addCellRenderer(new CustomTooltipRenderer()); // Force the table to re-render tableView.table.render(); }); });   --------- tooltipnew2.js -------- require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var CustomTooltipRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return cell.field === 'reference2'; }, render: function($td, cell) { var message = cell.value.split("|")[0]; var tip = cell.value.split("|")[1]; $td.html(_.template('<a href="#" data-toggle="tooltip" data-placement="right" title="<%- tip%>"><%- message%></a>', { tip: tip, message: message })); // This line wires up the Bootstrap tooltip to the cell markup $td.children('[data-toggle="tooltip"]').tooltip(); } }); mvc.Components.get('tblTooltip2').getVisualization(function(tableView) { // Register custom cell renderer tableView.table.addCellRenderer(new CustomTooltipRenderer()); // Force the table to re-render tableView.table.render(); }); }); --------   ... View more

| eval Account_Domain=mvindex( Account_Domain,0) Use this one it will take the 1st column. ... View more

virus true <panel depends="$bb$" rejects="$aa$"> <table> <search> <query>| makeresults | eval Url="https://answers.splunk.com/answers/751606/how-to-token-in-an-eval-sha256-function-under-a-si.html" | table Url | eval sha=sha256(Url)</query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <condition field="Url"> <set token="aa"></set> <unset token="bb"></unset> <link target="_blank">https://www.virustotal.com/gui/url/$row.sha$</link> </condition> </drilldown> </table> </panel> <panel depends="$aa$" rejects="$bb$"> <table> <search> <query>| makeresults | eval Url="https://answers.splunk.com/answers/751606/how-to-token-in-an-eval-sha256-function-under-a-si.html" | table Url </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">row</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="bb"></set> <unset token="aa"></unset> </drilldown> </table> </panel> You can use two panels the one will be hidden at a time. Only the thing is you have to click two times to get the answer. You can use this logic. Also, you have to use the init tag to set the "bb" token at the starting of the dashboard ... View more

Hi Harish you can try this way.. | eval "UTCepoch"= strptime(Date,"%d/%b/%Y %H:%M:%S %Z") , "AESTepoch=(UTCepoch +36000) , "AESTdate"= strftime(AESTepoch,"%d/%b/%Y %H:%M:%S %Z") In this way you will get date format in UTC to AEST. Here 36000 is time gap between UTC and AEST in seconds. ... View more