I have an event panel with 5 dropdown boxes as shown to be able to filter the base results based of 5 categories
This is the event search I created to return the base results
app=BP* sts=* | table at,req.bookingReference,app,mtd,cid,sts,dur,rsc,cal,req.offerOptionCode | rename req.bookingReference as bookingReference, req.offerOptionCode as offerOptionCode| search app=* AND mtd=* AND sts=* AND bookingReference=* AND cal=* | sort by at asc
When i remove the "search app=* AND mtd=* AND sts=* AND bookingReference=* AND cal=*" from the query, I then seem to get all the expected results which include POST PATCH and GET items, but with it included, I only get POST method results and not the GET and PATCH items.
i suspect the AND statements are the culprit...I tried OR but then the filters don't work and won't filter the base results.
Appreciate any guidance
Thanks
You must have field values in all these fields app, sts, bookingReference and cal for the events with field mtd contains PATCH/GET values
Try putting * in quotes.
app=BP* sts=* | table at,req.bookingReference,app,mtd,cid,sts,dur,rsc,cal,req.offerOptionCode | rename req.bookingReference as bookingReference, req.offerOptionCode as offerOptionCode| search app="*" mtd="*" sts="*" bookingReference="*" cal="*" | sort by at asc
Hello and thanks @manjunathmeti but still not working. I enclosed the * in quotes and removed the AND
app=BP* | table at,req.bookingReference,app,mtd,cid,sts,dur,rsc,cal,req.offerOptionCode|rename req.bookingReference as bookingReference, req.offerOptionCode as offerOptionCode | search app="*" mtd="*" sts="*" bookingReference="*" cal="*"| sort by at asc
Results still don't return API method PATCH and GET unless i remove the search statement
You must have field values in all these fields app, sts, bookingReference and cal for the events with field mtd contains PATCH/GET values
Oh ok I did not realise that @manjunathmeti
I was trying to present certain values in a columnised Table, but some of those values won't be populated for all API methods...which means then I may have to have separate panels in the dashboard for the particular API Method, I guess ☹️
Thanks for your guidance