I have some this like this |stats value(status) by time, id I want to print the latest time, values(status) in the order they got indexed or they happened by id. Can someone help, Thanks! ... View more

I have two dropdowns Dropdown one: Groups all the status codes, which will display "Client Error" OR "Server Error" Dropdown two: Is auto-populated depending on Dropdown one. For example: If Client Error is selected in Dropdown one, Dropdown two will have options like 404,401,405, etc. My default value is * (ALL) but, when it is passed to the search it is searching all the values with other than Client Error. I can group eval a group in all the searches, but I don't want to do that. The only other way is to pass all the value that is dynamically populated file to search with OR delimiter. Just to make it clear if Dropdown1: Client error and Dropdown 2: 400 404 406 Search should look like something like this: host=* statuscode= 400 OR 404 OR 406 | stats count by statuscode. <input type="dropdown" token="status" searchWhenChanged="true"> <label>Select response status code:</label> <choice value="*">ALL</choice> <change> <condition label="ALL"> <set token="status">$value$</set> </condition> </change> <fieldForLabel>s</fieldForLabel> <fieldForValue>s</fieldForValue> <search> <query>index=XXX "app"=D forwApp=$App$ host=$host$ | rename resStatus as s | eval Tstatus=case(like(s, "1%"),"Informational",like(s, "2%"),"Success",like(s, "3%"),"Redirection",like(s, "4%"),"Client Error",like(s, "5%"),"Server Error") | search Tstatus="$field3$" | dedup s</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> <input type="dropdown" token="field3" searchWhenChanged="true"> <label>Select response status:</label> <choice value="*">ALL</choice> <fieldForLabel>status</fieldForLabel> <fieldForValue>status</fieldForValue> <search> <query>index=XXX "app"=D forwApp=$App$ host=$host$ | rename resStatus as s | eval status=case(like(s, "1%"),"Informational",like(s, "2%"),"Success",like(s, "3%"),"Redirection",like(s, "4%"),"Client Error",like(s, "5%"),"Server Error") | dedup status</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <default>*</default> <initialValue>*</initialValue> </input> That is the code I'm using. Thanks for your time! ... View more