To create dashboard for win EventIDs

[phanikumarcs]

Hi @ITWhisperer

need help, how many ways to show up in the dashboard where the eventids

index=foo_win*  (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1").......
where _time, server(host), eventid, severity (warning, critical, info)

Desired to achieve like below snap.

[ITWhisperer]

For each panel, what search are you using or going to use?

[phanikumarcs]

@ITWhisperer  i created like this,

in the Event Types

index=foo_win*  (host="PC*" EventID=1068) OR (host="PR**" EventID="1") OR (host="PR*" EventID="1") OR (host="PR*" EventID="1")
| eval Severity=case(EventID="1068", "Warning",
EventID="1", "Information",
EventID="1021", "Warning")
| stats count by Severity

writing above spl under all three pannels(critical, warning,information)

[ITWhisperer]

OK so it is not clear what you are asking for. Please can you expand on your usecase and the issue(s) you are facing?