topic Re: Working with two filters for one event row in Getting Data In

Working with two filters for one event row

vtsguerrero — Fri, 25 Jul 2014 13:30:08 GMT

I have one drop down and one text input, I need the user to be able to by both components OR INDIVIDUAL, one optional and they are both used for just one event row...

index=main source type=main_error ChannelCode=$channel$ OR ProcessCode=$process$

Can anyone explain this search string to me ?
Thanks in advance!

Re: Working with two filters for one event row

vtsguerrero — Fri, 25 Jul 2014 16:37:00 GMT

It's only searching both mandatory :X

Re: Working with two filters for one event row

vtsguerrero — Fri, 25 Jul 2014 18:38:20 GMT

Sorry when I said filter, I meant two inputs...

Re: Working with two filters for one event row

strive — Fri, 25 Jul 2014 19:29:58 GMT

Do you mean "both the fields to be mandatory". In you search with that OR condition, even if user gives any one input the search will execute.

Re: Working with two filters for one event row

vtsguerrero — Sat, 26 Jul 2014 23:22:46 GMT

When searching using a searchString, it's only searching if user choose a dropdown value and also type something in the text input, and I wanted to be able to search individually independent.

Re: Working with two filters for one event row

somesoni2 — Mon, 28 Jul 2014 12:56:19 GMT

You can use the value as "*" for the dropdown/text box so that if User doesn't selects a filter, its default value * will be supplied.

E.g. dashboard

Updated

 <form>
  <label>DynamicChartTitle</label>
  <description>NULL</description>
  <fieldset autoRun="true">
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>*</default>
      <populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
        <![CDATA[index=_internal earliest=-1h@h | stats count by sourcetype | table sourcetype ]]>
      </populatingSearch>
    </input>
    <input type="text" token="source" searchWhenChanged="true">
      <label>Source</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <table>
      <title>The chart tile</title>
      <searchString>index=_internal [|gentimes start=-1 
        | eval search=if("$sourcetype$"="*","","sourcetype=\"$sourcetype$\"")
        | eval search=case("$source$"="*",search, search !="",search." OR source=\"$source$\"",1=1,"source=\"$source$\"") | table search]
        | stats count by sourcetype, source</searchString>
      <earliestTime>-1h</earliestTime>
      <latestTime>now</latestTime>            
    </table>
  </row>
</form>

Re: Working with two filters for one event row

tom_frotscher — Mon, 28 Jul 2014 13:38:43 GMT

This is a good approach in general for the mentioned problem. But can't there be some side effects in this special case? Because the fields are combined with the OR operator.

Re: Working with two filters for one event row

somesoni2 — Mon, 28 Jul 2014 14:28:42 GMT

I had overlooked the OR condition between two filters. I have added some logic to handle that situation. Try the updated answer.