<form version="1.1">
  <label>AD Objects - Admin - User - Events</label>
  <search id="user_tracking">
    <query>($token_sourcetype$) $token_search_extra$ ($token_host$) (user=$token_user$ OR src_user=$token_user$ OR  User=$token_user$)
| fields _time, sourcetype, user, User, src_user, _raw, host</query>
    <earliest>$token_time.earliest$</earliest>
    <latest>$token_time.latest$</latest>
  </search>
  <fieldset submitButton="true">
    <input type="multiselect" token="token_sourcetype" searchWhenChanged="true">
      <label>Select Sourcetypes</label>
      <choice value="*">All</choice>
      <search>
        <query>| metadata type=sourcetypes | table sourcetype | sort sourcetype</query>
      </search>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <valuePrefix>sourcetype="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>*</default>
    </input>
    <input type="multiselect" token="token_host" searchWhenChanged="true">
      <label>Select Host</label>
      <choice value="*">All</choice>
      <search>
        <query>| metadata type=hosts | table host| sort host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <valuePrefix>host="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>*</default>
    </input>
    <input type="text" token="token_user" searchWhenChanged="true">
      <label>Enter User Name</label>
      <default>admin*</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
      <initialValue>admin*</initialValue>
    </input>
    <input type="text" token="token_search_extra" searchWhenChanged="true">
      <label>Extra Search Text</label>
      <default></default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="time" token="token_time" searchWhenChanged="true">
      <label>Select Target Time Period</label>
      <default>
        <earliest>-4h@m</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Count by sourcetype</title>
        <search base="user_tracking">
          <query>stats count by sourcetype
| sort -count</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
      <chart>
        <title>Count Over Time</title>
        <search base="user_tracking">
          <query>timechart limit=10 count by sourcetype</query>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <title>Transaction of Raw Events for Users</title>
        <search base="user_tracking">
          <query>eval User=if(isnull(user),if(isnull(src_user),if(isnull(User),"Unknown",User),src_user),user)
| transaction sourcetype, User, host
| highlight $token_user$</query>
        </search>
        <option name="count">10</option>
        <option name="list.drilldown">full</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>