Hi @javiergn    Thanks for you input   Total no of ports     Down ports    percDownPorts 599                               599                     100 its giving the correct total no of ports but down ports count is 234 is giving wrong value for down ports.. is there any other way to fetch the output ... View more

Hi, Thanks for you input   Total no of ports     Down ports    percDownPorts 599                               599                     100 its giving the correct total no of ports but down ports count is 234 is giving wrong value for down ports.. is there any other way to fetch the output ... View more

Hi @gcusello  Yes first and second dropdown are linked together and tokens are $group$ and $device$. But I dont know how to create third dropdown Timeframe and link first two dropdowns.   Thanks, priya   ... View more

Hi @gcusello, Thank you so much for your input. Itworked fine ... View more

Hi @to4kawa , Couldn't see your solution can you send me again? Thanks ... View more

Hi @to4kawa , I didn't get output for this, Could you please help me in solving this?   ... View more

@dmarling  Hi,  Thanks for the help!! There is another query with the join. I tried replacing with "OR" but I'm not getting exact output "index=167515-np sourcetype=hardware | fields deviceId, productType, productId, physicalType | search physicalType=Chassis | dedup deviceId | join deviceId [ search index=167515-np [| `last_np_sourcetype( "index=167515-np", "group_members")` ] groupId=288348 | fields deviceId ] | stats dc(productId) as PIDs by productType | search productType=Routers | table PIDs" Could you please help me in solving this?? Thanks ... View more

@bowesmana  Hi Bowesmana, Can you also help me in solving the query ?   Thanks. ... View more

Hi @dmarling  Thanks for replying the below query which you shared it not working exactly. I would like to give some inputs, This is query with join: " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId | table deviceName, physicalElementId, hwEoxId | stats count as Devices by hwEoxId | stats sum(Devices) as Devices" sample ouput of the  1stquery " index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId" cpyKey: 168347    currentEoxMilestone: LDoS    currentEoxMilestoneDate: 2018-01-31T00:00:00    deviceId: 18468220    deviceName: 10.24.13.240    hwEoxId: 286609    nextEoxMilestone: null    nextEoxMilestoneDate: null    physicalElementId: 362026445    physicalType: Power Supply    productId: C3K-PWR-265WAC    timeStamp: 2020-12-15T12:57:03 Output of second query"index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=309425 | fields deviceId" "deviceId:16642716 groupId:309425 groupName:Cisco 3900 ISR Routers timeStamp:2020-12-15T12:56:41" Output of the query till dedup of physicalElementId  "index=168347-np [| `last_np_sourcetype("index=168347-np", "hw_eox")`] currentEoxMilestone=EoSCR OR currentEoxMilestone=LDoS (physicalType=*) | fields deviceId, deviceName, physicalElementId, hwEoxId | join deviceId [ search index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId ] | fields deviceName, physicalElementId, hwEoxId | dedup physicalElementId" '' ''cpyKey: 168347 currentEoxMilestone:LDoS currentEoxMilestoneDate:2018-03-31T00:00:00 deviceId:15459204 deviceName:10.82.112.71 hwEoxId:266079 nextEoxMilestone:null nextEoxMilestoneDate:null physicalElementId:341757347 physicalType:Module productId:SFP-GE-L timeStamp:2020-12-15T12:57:02"" Also I have attached the table values as pdf  for ""| table deviceName, physicalElementId, hwEoxId""   Please help me in removing the join in the query at the top. Thanks a lot ... View more

@dmarling  Hi, Any update on the above query? ... View more

Content of first query "index=168347-np [ | `last_np_sourcetype("index=168347-np","hardware")`] (physicalType=*) | fields physicalElementId deviceId " This query has 39718 events  similarly like below "chassisName: 10.241.241.22    cpyKey: 168347    deviceId: 19206245    deviceName: 10.241.241.22    hwRev: null    installedFlash: null    installedMemory: null    pcb: null    pcbRev: null    physicalElementId: 388725541    physicalSubType: null    physicalType: Power Supply    productFamily: Catalyst 2K/3K Series Power Supplies    productId: PWR-C1-1100WAC    productType: Power Supplies    serialNumber: DTN2246V1S4    serialNumberStatus: UNKNOWN    slot: PWRSPPLY2    swVersion: null    tan: null    tanRev: null    timeStamp: 2020-12-14T13:35:46" Content of second query: "index=168347-np [| `last_np_sourcetype( "index=168347-np", "group_members")` ] groupId=290681 | fields deviceId" This query has 25 events similarly like below { [-]    deviceId: 16681845    groupId: 290681    groupName: ASR 1K Routers    timeStamp: 2020-12-14T13:35:27 }     Final output is: 210 ... View more