Hi folks, thank you for the quick replies and the great suggestions. @gcusello I like the append solution, this is great, however, like you mention it isn't the most efficient, especially if considering adding a third or even fourth row. I did consider expanding the dashboard base search in the background, creating another search id, but again, not the most efficient. @bowesmana Not tried this way yet, will give it a go today. Will this way efficiently handle varying time windows from the time picker? Not sure how multiplying the average per minute by 60 to get an hour would be effective, perhaps it will, I can compare the different result sets I get. As you've mentioned there's a ton of ways to achieve results in Splunk, I'm relatively new to it but it's been invaluable in analysing API xml and json logs. Having a lot of fun! Thanks again.
... View more
