summaryindex is = mysummary_index I am writing all the above into summary index by using search query below.
index=mysupport_core sourcetype=mysupport_app_log event=ApiSummaryEvent api=LinkingToolController.linkProduct apiStatus=* | stats avg(apiActualTimeTaken) as AVG_Actual avg(realTime_timeTaken) as AVG_real avg(cached_timeTaken) as AVG_cached P95(apiActualTimeTaken) as P95_Actual P95(realTime_timeTaken) as P95_real P95(cached_timeTaken) as P95_cached
Pls help me achieve same with 3 dropdown (All, RealTime, Cached ) that output search for respective drop-down. (one-token-multiple value-perhaps)
index=mysummaryindex | stats sum(AVGActual or AVGreal or AVGcached ) as AVG sum(P95Actual or P95real or P95cached) as per dropdown(All, RealTime, Cached ) respectively.
I tried This article helped a bit but could not achieve yet.