Dynamic | stats count

[MrJohn230]

I'm not exactly sure what I need here. 

I have a multiselect:

 <input type="multiselect" token="t_resource">
      <label>Resource</label>
      <choice value="*">All</choice>
      <prefix>IN(</prefix>
      <suffix>)</suffix>
      <delimiter>,</delimiter>
      <fieldForLabel>resource</fieldForLabel>
      <fieldForValue>resource</fieldForValue>
      <search base="base_search">
        <query>| dedup resource | table resource</query>

Table visual search:

| search status_code $t_code$ resource $t_resource$ HourBucket = $t_hour$
| bin _time span=1h
| stats count(status_code) as StatusCodeCount by _time, status_code, resource
| eventstats sum(StatusCodeCount) as TotalCount by _time, resource
| eval PercentageTotalCount = round((StatusCodeCount / TotalCount) * 100, 2)
| eval 200Flag = case(
    status_code=200 AND PercentageTotalCount < 89, "Red",
    status_code=200 AND PercentageTotalCount < 94, "Yellow",
    status_code=200 AND PercentageTotalCount <= 100, "Green",
    1=1, null)
| eval HourBucket = strftime(_time, "%H")
| table _time, HourBucket, resource, status_code, StatusCodeCount, PercentageTotalCount, 200Flag

I also have a table, sample data below:

_time	resource
1/10/2024	Red
1/10/2024	Green

When the user select the multiselect dropdown and selects "ALL" (which is the default) the resource column should aggregate all the resource and display the resource as "All". But If the user select individual resources, such as "Red" and "Green" these should be shown and broken down by resource. 

[bowesmana]

You could do a simple

| eval resource=if($t_resource|s$="IN(*)", "All", resource)

which would make all resources be "All" if the only selected dropdown is "All", so the split by resource only creates a single split, of you could add a change element to the input that sets the split by clause, e.g. something like

<change>
  <eval token="split_by_resouce">if($t_resource|s$="IN(*)", "", "resource")</eval>
</change>

and then change your stats (and eventstats) command to

| stats count(status_code) as StatusCodeCount by _time, status_code, $split_by_resource$

You would also need a default for that token, so need an init block, i.e.

<init>
  <set token="split_by_resource"></set>
<init>

and then you would also need to create a 'resource' field to be "All" for the final table display if you want "All" to appear. The first option requires the least fiddling around