Hi,
I have a simple checkbox as shown below -
All Event1 Event2 Event3 Event4 $$payload.type$$ == " " OR *
I have a query which basically checks if Type is "A" or "B" and based on that selects x and y axis of a column chart. When Type is "B" I want to further filter using radio button as shown in query(AND $eventtype$) which would evaluate to $$payload.type$$ == "Event?". But as this is a case statement "*"(for All case) regex matching does not work. What can I use such that for the case "All" anything can match? Also, if I am over-complicating this, is there an easier way to do this?
index="app_event"
| eval myFan=mvrange(0,3)
| mvexpand myFan
| eval _time = case(myFan=0 AND Type == "A", $$payload.beginVal$$,
myFan=1 AND Type == "A", $$payload.endVal$$,
myFan=2 AND Type == "B" AND $eventtype$, $$payload.beginVal$$)
| eval phase = case(myFan=0 AND Type == "A", "BeginVal",
myFan=1 AND Type == "A", "EndVal",
myFan=2 AND Type == "B" AND $eventtype$, $$payload.name$$)
| eval Time = strftime (_time/pow(10,9), "%F %T.%9Q")
| chart count by Time phase
↧