Try this!
index=myIndex value1!=True
| stats count by siteID
| map search="search index=myIndex earliest=-2d value2!=True siteID=\"$siteID$\"
| stats latest(_time) as lastContact by siteID, siteName, region, siteType"
※When siteID is a character string
↧