How to use radio button choices in case statements?

[dhruv101]

Hi,

I have a simple checkbox as shown below -

<input type="checkbox" token="eventtype" searchWhenChanged="true">
      <label>Event Type</label>
      <choice value="*">All</choice>
      <choice value="Event1">Event1</choice>
      <choice value="Event2">Event2</choice>
      <choice value="Event3">Event3</choice>
      <choice value="Event4">Event4</choice>
      <valuePrefix>$$payload.type$$ == "</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <default>*</default>
    </input>

I have a query which basically checks if Type is "A" or "B" and based on that selects x and y axis of a column chart. When Type is "B" I want to further filter using radio button as shown in query(AND $eventtype$) which would evaluate to $$payload.type$$ == "Event?". But as this is a case statement "*"(for All case) regex matching does not work. What can I use such that for the case "All" anything can match? Also, if I am over-complicating this, is there an easier way to do this?

    index="app_event"  
    | eval myFan=mvrange(0,3) 
    | mvexpand myFan 
    | eval _time = case(myFan=0 AND Type == "A", $$payload.beginVal$$, 
       myFan=1 AND Type == "A", $$payload.endVal$$, 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.beginVal$$) 
    | eval phase = case(myFan=0 AND Type == "A", "BeginVal", 
       myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$) 
    | eval Time = strftime (_time/pow(10,9), "%F %T.%9Q") 
    | chart count by Time phase

[renjith_nair · Accepted solution]

Hi @dhruv101 ,

Either you could you case(match(field,"regex")) or you could push the * as a default statement in the case

     | eval phase = case(myFan=0 AND Type == "A", "BeginVal",  myFan=1 AND Type == "A", "EndVal", 
       myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$,1==1,"All my selections end up here")