I think you got bit by an issue Splunk has with using fields that include spaces in evals. A rename of the Destination Country Correct Translation to a field name with no spaces would have sorted it. index = "myindex" | rename "Destination Country Correct Translation" as Country | eval Country = case(Country=="A","A",Country=="B","B",Country=="C","C",Country=="D","D",Country=="E","E",true(),"Others") | stats sum("Declared Value _USD") as sales by Country | eventstats sum(sales) as total_sales | eval Percentage=sales/total_sales*100 | sort 0 - sales ... View more

If you haven't already, maybe check out this example: https://github.com/splunk/splunk-sdk-java/blob/master/examples/com/splunk/examples/search/Program.java Look at line 103. Couldn't you do something similar to test if there are results in the OutputList array and if not, format as events? ... View more

index = "myindex" | eval "Destination Country Correct Translation" = case("Destination Country Correct Translation"=="A","A","Destination Country Correct Translation"=="B","B","Destination Country Correct Translation"=="C","C","Destination Country Correct Translation"=="D","D","Destination Country Correct Translation"=="E","E",true(),"Others") | stats sum("Declared Value _USD") as sales by "Destination Country Correct Translation" | eventstats sum(sales) as total_sales | eval Percentage=sales/total_sales*100 | sort 0 - sales ... View more

This may get a little far from your original question, but including it in case it's helpful: If you are providing a way for your user to select their search times anyway, then you can just use that token elsewhere in your title. Personally I would rather display the end of the search period rather than the last event found. If so, then use the earliest and latest modifiers, for example: $timer_tok.latest$ Alternately if you want to know when the Search Job stopped, try $job.latestTime$ This page has some great token info including both of those examples: https://docs.splunk.com/Documentation/Splunk/7.2.0/Viz/tokens ... View more

Put an eval like this before the transform command that gives you the Sales by Country: eval Country = case(Country=="A","A",Country=="B","B",Country=="C","C",Country=="D","D",Country=="E","E",true(),"Others") for example: index="myindex" | eval Country = case(Country=="A","A",Country=="B","B",Country=="C","C",Country=="D","D",Country=="E","E",true(),"Others") | stats count as Sales by Country | eventstats sum(Sales) as TotalSales | eval Percentage = Sales / TotalSales ... View more

Hi Nick, For clarification, is the HTML in an HTML dashlet that is included in a Simple XML form or have you used the Convert to HTML menu? ... View more