topic Re: Complete search string based on a drop down in Dashboards & Visualizations

Complete search string based on a drop down

nebel — Fri, 10 Aug 2012 13:40:19 GMT

Hi,

lets say I have a drop down with "red" and "green".
If I choose red the search should look like:

index=red | top red_user

If I chosse green the search should look like:

index=green | top green_user

Normally it is not a problem to use the token from the drop down in a search, but how can I handle it if the complete search should changing after choosing a field in the drop down?

Thank you

Regards

Re: Complete search string based on a drop down

lguinn2 — Fri, 10 Aug 2012 13:45:28 GMT

The token is substituted into the search string. So if the token is $var$, you could simply put it in the search template (of the XML) as

<searchTemplate>
    index=$var$ | top $var$_user
 </searchTemplate>

This should work...

Re: Complete search string based on a drop down

nebel — Fri, 10 Aug 2012 13:48:58 GMT

Hi,

this was just an easy example, my searches are more complicated with regex and stuff. I think I have to replace the complete search based on the drop down.

Thank you

Regards

Re: Complete search string based on a drop down

nebel — Wed, 29 Aug 2012 14:00:38 GMT

does nobody know how I can change the full search string by choosing a field in a drop down?

Re: Complete search string based on a drop down

lguinn2 — Wed, 29 Aug 2012 17:18:12 GMT

Create a macro for each case. In the drop-down, put the name of the macro for the value that corresponds to each choice.

The search template then could be

<searchtemplate>
    `$var$`
</searchtemplate>

That's the best that I can come up with. Plus it gives you the flexibility to change the macro without changing the dashboard.

Re: Complete search string based on a drop down

nebel — Thu, 30 Aug 2012 13:53:26 GMT

thank you very much!