Dealing with Multiple dynamic input such as country

[chiennylin]

Currently, we are extracting the total of bagging per country and this is being stored in a report.
the report output looks like this:
01/15/2020 07:45:00 +0000, search_name=BT_COUNTRY_TOTAL_SHP, search_now=1579075200.000, info_min_time=1579071600.000, info_max_time=1579075200.000, info_search_time=1579075209.762, AE=2, AU=5, BG=0, CH=0, CM=0, CN=3, CZ=4, FI=1, FR=1, GR=1, HK=2, HU=0, IE=0, IN=0, IQ=0, IT=2, JP=2, KR=1, KW=1, KZ=0, LT=0, MX=12, NG=1, NO=0, NZ=2, PL=0, PT=1, RO=3, RU=1, SA=0, SE=0, SG=1, SI=2, TR=13, US=17, VN=0, ZA=1, report="BT_COUNTRY_TOTAL_SHP"

Moving to dashboard, i don't know what is the best strategy to make country a dynamic checkbox that will sum up via timechart.

unlike in region, we have 251 countries define in total.
in region, i use this for my dashboard:

for input i define it like this: but i had to REX all the region
input id="region_id" type="checkbox" token="region"
Select Region
choice value="sum(AM) as "AM""
choice value="sum(AP) as "AP""

index=*ocnt_summary source=$BTYPE2$
| rex "AM=(?<AM>\d+)"
| rex "AP=(?<AP>\d+)"
| rex "CN=(?<CN>\d+)"
| rex "EU=(?<EU>\d+)"
| rex "ME=(?<ME>\d+)"
| rex "SB=(?<SB>\d+)"
| timechart span=$span$ $region$

For country, aside from during REX for all the country, I don't know if I have any other options.
HELP!

[to4kawa]

| makeresults 
| eval _raw="01/15/2020 07:45:00 +0000, search_name=BT_COUNTRY_TOTAL_SHP, search_now=1579075200.000, info_min_time=1579071600.000, info_max_time=1579075200.000, info_search_time=1579075209.762, AE=2, AU=5, BG=0, CH=0, CM=0, CN=3, CZ=4, FI=1, FR=1, GR=1, HK=2, HU=0, IE=0, IN=0, IQ=0, IT=2, JP=2, KR=1, KW=1, KZ=0, LT=0, MX=12, NG=1, NO=0, NZ=2, PL=0, PT=1, RO=3, RU=1, SA=0, SE=0, SG=1, SI=2, TR=13, US=17, VN=0, ZA=1, report=\"BT_COUNTRY_TOTAL_SHP\"" 
| kv
| rex "(?<time>\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} \+\d+)"
| eval _time=strptime(time,"%m/%d/%Y %T %z")
| fields - _raw time

Hi, @chiennylin
try kv

[TISKAR · Accepted solution]

Hello,

Can you try this please, i simulate your report with creating raw filed, and then i extract country value, You can copy and past this request :

| makeresults 
| eval raw="01/15/2020 07:45:00 +0000, search_name=BT_COUNTRY_TOTAL_SHP, search_now=1579075200.000, info_min_time=1579071600.000, info_max_time=1579075200.000, info_search_time=1579075209.762, AE=2, AU=5, BG=0, CH=0, CM=0, CN=3, CZ=4, FI=1, FR=1, GR=1, HK=2, HU=0, IE=0, IN=0, IQ=0, IT=2, JP=2, KR=1, KW=1, KZ=0, LT=0, MX=12, NG=1, NO=0, NZ=2, PL=0, PT=1, RO=3, RU=1, SA=0, SE=0, SG=1, SI=2, TR=13, US=17, VN=0, ZA=1, report=\"BT_COUNTRY_TOTAL_SHP"
| rex field=raw max_match=0 "(?<country>\w{2}\=\d+)"
| table country
| mvexpand country
| rex field=country max_match=0 "(?<country>\w{2})=(?<value>\d+)"

[chiennylin]

Thanks! this works perfectly!