Hi,
I have a query which does the stats count by ID selected through the drop-down query looks like :
index=servers sourcetype=json Id=* msg="method" OR "disabled" earliest=-60m@m latest=now | stats count as cnt by _time,msg, Id | head limit=20
I want to display two columns in the panel which display the count when Id=* and when Id=number respectively. Where a number can be any choice from the drop-down.
Assuming you're using the Id dropdown token as $id$
in the base search, try like this. This will show id=*
on all rows if the Id selected from dropdown was *
(all Ids) ,will show Id=selectedId otherwise.
index=servers sourcetype=json Id="$id$" msg="method" OR "disabled" earliest=-60m@m latest=now | eval Id=if("$id$"="*","*",id) | stats count as cnt by _time,msg, Id | head limit=20
Thanks, I was thinking to do the same thing but it is displaying * under the column Id.