data is not populating using dropdown selection

[Khushboo]

Hi Everyone,

I have extracted field  name status using rex. Then I have added dropdown input in which I have all the values of status. 
But data is not getting refreshed after selecting any value from dropdown.
Though i have tried highlighted (status = $status$ ) in base query, where another dropdown with name level is working fine.

PFB snippet of my code:
<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ status = $status$
| sort id asc
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>

[scelikok · Accepted solution]

Please try as below;

<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ 
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
| search status = $status$
| sort id asc
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>

[scelikok]

Hi @Khushboo, you are filtering before extracting status field. Please try below;

<form>
<search id="base_search">
<query>
index=abc sourcetype=xyz earliest = $earliest$ latest = now()
id = $id$ level = $level$ 
| rex field=msg "\{\"status\"\:\s+\"(?&lt;status&gt;[^\"\}]+)"
| where status = $status$
| sort id asc
</query>
</search>
<fieldset submitButton="false" autoRun="false">
<input type="dropdown" token="id" searchWhenChanged="true">
<label>Request Id</label>
<choice value="*">ALL</choice>
<fieldForLabel>id</fieldForLabel>
<fieldForValue>id</fieldForValue>
<search base="base_search_filter">
<query>search | dedup id
| table id</query>
</search>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="status" searchWhenChanged="true">
<label>Status</label>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>status</fieldForLabel>
<fieldForValue>status</fieldForValue>
<search base="base_search_filter">
<query> search | dedup status
| table status</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base_search">
<query> search
| table id,  status,
</query>
</search>
<option name="drilldown">row</option>
</table>
</panel>
</row>
</form>

[Khushboo]

It is throwing me error:
Error in 'where' command: The expression is malformed. An unexpected character is reached at '* '.