Hi, i am having an error of getting this user input for a drop-down to work where i am unable to find any errors within my code. Can somebody help me for this error? This is the error i am getting. This is my search query (sourcetype="windows event logs" OR sourcetype="General-linux-sql.log" OR sourcetype="csv") | eval spec_IP=case ([|search sourcetype="General-linux-sql.log"], [| rex field=_raw "\[(?<IP_addr>\d+.\d+.\d+.\d+)\]"], [| search sourcetype="csv"], [| rex field=_raw ",(?<src_ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}),\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3},,,"], [| search sourcetype="windows event logs"], [| search *"Account Locked"* | rex field=_raw "\[(?<acc_ip>\d+.\d+.\d+.\d+)\]"] ) | stats count by Specific_IP
... View more