@niketn,
Continuation..
Based on the given inputs, the query i have given for panel is.
index=""| eval name="$fieldname_tok$"| eval name= if(name="", , name)|search Interface="$interface_tok$" AND SourceApplication="$source_tok$" AND name="$value_tok$"| rename name as "FreeField"| table Interface, SourceApplication, FreeField
This query works for "*" condition, however it fails when input field is selected from drop down as,
| eval name="$fieldname_tok$"| -------- token is taken as string rather than field name.
So I am stuck with satisfying both conditions. Please help
Thanks,
Bhagyashri S
... View more