I have a drop down which I populate with the query and editing field values
index="myindex"|stats values(Category) as categories|rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/"| mvexpand categories|eval label= categories |eval value = categories
Now since I had changed drop down values how will i pass the original field value as token to my search query where it will work
index="myindex" **Category=$categories$**| chart count over sourcetype by "Priority" | addtotals fieldname=Total| foreach * [eval Req_Percent = count *100 / Total] | fields - Total
This is not working.. I want to pass the category i select from drop down and change it to field value and pass to query.. How can i accomplish that.. Please help
↧