I am trying to put the name(s) of a selected item(s) into the 'first' and 'last' parameters of a streamstats evaluation, with no success. Hoping someone can help.
The form query below gathers a list of distinct Adobe products installed and creates a checkbox selection list. My goal is to produce a report showing recent changes of Adobe software versions on computers. As checkboxes go, I'd like to be able to select more than one software product.
I've searched high and low for that magic keyword but have yet to find it.
fyi...The software index data is comprised of domain computer information, including what software is installed.
<form>
<label>Adobe Software Changes</label>
<description>Software Changes</description>
<fieldset autorun="false" submitButton="true">
<input type="time" searchWhenChanged="true"></input>
<input type="checkbox" token="AdobeType">
<label></label>
<populatingSearch fieldForValue="column" fieldForLabel="column">index="software" sourcetype="software" | stats dc(Adobe*) as Adobe* | transpose</populatingSearch>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix></valuePrefix>
<valueSuffix>!="*no*"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<table>
<searchTemplate>index=software sourcetype=software $AdobeType$|streamstats global=f current=t window=2
last($click.value2$) as Lastc
first($click.value2$) as Firstc by ComputerName
|Fields - _raw index _time sourcetype|Fields keepcolorder=t ComputerName UserName Users timestamp</searchTemplate>
<title>Adobe Products and Versions</title>
<option name="showPager">true</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
... View more