<panel>
  <table>
    <search>
      <query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest &gt; 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")` | search user=$user$</query>
    </search>
    <option name="drilldown">cell</option>
    <option name="wrap">false</option>
  </table>
</panel>