Figured it out so I thought I would share.
The drop downs are first.
<row>
<panel>
<input type="dropdown" token="some_usr_tok" searchWhenChanged="true">
<label>Filter by $userChoicetok$</label>
<choice value="*">ALL</choice>
<default>ALL</default>
<search>
<query>index=wired_index MAC!=MAC | stats count by MAC | sort MAC</query>
</search>
<fieldForLabel>MAC</fieldForLabel>
<fieldForValue>MAC</fieldForValue>
</input>
<input type="dropdown" token="another_usr_tok" searchWhenChanged="true">
<label>Filter by $userNewchoice$</label>
<choice value="*">ALL</choice>
<default>ALL</default>
<search>
<query>index=wired_index IP!=IP | stats count by IP | sort IP</query>
</search>
<fieldForLabel>IP</fieldForLabel>
<fieldForValue>IP</fieldForValue>
</input>
</panel>
</row>
I used five of these, but for brevity I only listed two.
Now the table.
<row>
<panel id="scroll_2">
<table depends="$showWired$">
<search>
<query>index=wired_index date_time!=date_time | search MAC=$some_usr_tok$ | search IP=$another_usr_tok$
| stats list(MAC) as MAC by date_time IPd| table date_time MAC IP| sort -date_time</query>
<earliest>0</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="rowNumbers">true</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
This should let you filter down as specific as you like, there are probably more elegant ways, but it works. I would like to thank to4kawa for trying to help me work through this. どうもありがとうございました.
... View more
