index="cisco" hostname=* (cat_name=passed OR cat_name=failed) type="Ethernet" | eval site=case(substr(NetworkDeviceName,1,7)=="mysite",substr(NetworkDeviceName,1,7) + substr(NetworkDeviceName, -4),1=1,substr(NetworkDeviceName,1,7) ) | stats count by site mac_address cat_name type | eval type_cat_name=type."_".cat_name | eval site_mac=site."_".mac_address | xyseries site_mac type_cat_name count | rex field=site_mac "(?<site>.*)_(?<mac>.*)" | search "Call Check_CISE_Failed_Attempts">=1 AND "Call Check_CISE_Passed_Authentications"="NULL" AND "Framed_CISE_Failed_Attempts"="NULL" AND "Framed_CISE_Passed_Authentications"="NULL" | chart dc(mac) As Endpoints by site
So the result is a column chart that shows for each site the count of mac address that correspond to the search condition. Now if I want to click on a column I go to another dashboard for the specific site and for the mac address I need additional fields to show in a table like site, mac_address, port, interface. I tried to add this field in the by clause after stats but it seems doesn't work.