Hi @Harish2 , the most efficient solution is using a lookup, if you aren0t enabled to do this, you have to insert in the input all the conditions, somethin ike this: <form version="1.1" theme="light">
<label>Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="timepicker">
<label>TimeRange</label>
<default>
<earliest>-15m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="env">
<label>Environment</label>
<choice value="*">All</choice>
<prefix>env="</prefix>
<suffix>"</suffix>
<default>*</default>
<fieldForLabel>env</fieldForLabel>
<fieldForValue>env</fieldForValue>
<search>
<query>
| makeresults | eval env="DEV" | fields env
| append [ | makeresults | eval env="SIT" | fields env ]
| append [ | makeresults | eval env="UAT" | fields env ]
| append [ | makeresults | eval env="SYS" | fields env ]
| sort env
| table env
</query>
</search>
</input>
<input type="dropdown" token="server">
<label>Server</label>
<choice value="*">All</choice>
<prefix>server="</prefix>
<suffix>"</suffix>
<default>*</default>
<fieldForLabel>server</fieldForLabel>
<fieldForValue>server</fieldForValue>
<search>
<query>
| makeresults | eval env="DEV", server="amptams.dev.com" | fields env server
| append [ | makeresults | eval env="DEV", server="ampvitss.dev.com" | fields env server ]
| append [ | makeresults | eval env="DEV", server="ampdoctrc.dev.com" | fields env server ]
| append [ | makeresults | eval env="SIT", server="ampastdmsg.dev.com" | fields env server ]
| append [ | makeresults | eval env="SIT", server="ampmorce.dev.com" | fields env server ]
| append [ | makeresults | eval env="SIT", server="ampsmls.dev.com" | fields env server ]
| append [ | makeresults | eval env="UAT", server="ampserv.dev.com" | fields env server ]
| append [ | makeresults | eval env="UAT", server="ampasoomsg.dev.com" | fields env server ]
| append [ | makeresults | eval env="SYS", server="ampmsdser.dev.com" | fields env server ]
| append [ | makeresults | eval env="SYS", server="ampastcol.dev.com" | fields env server ]
| search $env$
| dedup server
| sort server
| table server
</query>
</search>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Incoming Count & Total Count</title>
<search>
<query>
index=app-index
source=application.logs
$env$
$server$
(
"Initial message received with below details" OR
"Letter published correctley to ATM subject" OR
"Letter published correctley to DMM subject" OR
"Letter rejected due to: DOUBLE_KEY" OR
"Letter rejected due to: UNVALID_LOG" OR
"Letter rejected due to: UNVALID_DATA_APP"
)
| rex field= _raw "application :\s(?<Application>\w+)"
| rex field= _raw "(?<Msgs>Initial message received with below details|Letter published correctley to ATM subject|Letter published correctley to DMM subject|Letter rejected due to: DOUBLE_KEY|Letter rejected due to: UNVALID_LOG|Letter rejected due to: UNVALID_DATA_APP)"
| chart count over Application by Msgs
| rename
"Initial message received with below details" AS Income,
"Letter published correctley to ATM subject" AS ATM,
"Letter published correctley to DMM subject" AS DMM,
"Letter rejected due to: DOUBLE_KEY" AS Reject,
"Letter rejected due to: UNVALID_LOG" AS Rej_log,
"Letter rejected due to: UNVALID_DATA_APP" AS Rej_app
| table
Income Rej_app ATM DMM Reject Rej_log Rej_app
</query>
<earliest>timepicker.earliest</earliest>
<latest>timepicker.latest</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentageRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<form> Ciao. Giuseppe
... View more