topic Re: How to edit my XML for drop-down inputs to properly filter on expected field values? in Dashboards & Visualizations

How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac — Thu, 30 Jun 2016 16:23:25 GMT

I have an issue with my drop-down inputs in my dashboard. If I select a dest port 80 from my list, I expect to only see dest port 80 in my results. However, it's also filtering on the source port 80. How can I stop this behavior, because it's occurring in other dashboards that I have?

 </input>
    <input type="multiselect" token="Dest_Port" searchWhenChanged="true">
      <label>Select a Dest Port:</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(Dest_Port) as Dest_Port | mvexpand Dest_Port | sort Dest_Port</query>
      </search>
      <fieldForLabel>Dest_Port</fieldForLabel>
      <fieldForValue>Dest_Port</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="URL" searchWhenChanged="true">
      <label>Select URL</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(URL) as URL | mvexpand URL | sort URL</query>
      </search>
      <fieldForLabel>URL</fieldForLabel>
      <fieldForValue>URL</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>sourcetype="udp:514" host="172.20.1.62" $User$ $Action$ $Src_IP$ $Dest_IP$ $Dest_Port$ $URL$ | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">100</option>
      </table>
    </panel>
  </row>
</form>

Re: How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac — Thu, 30 Jun 2016 16:41:07 GMT

Also, what I am seeing is that it looks for the value of what I am searching for all throughout the raw data.

Re: How to edit my XML for drop-down inputs to properly filter on expected field values?

gcusello — Tue, 29 Sep 2020 10:05:08 GMT

in your search I don't see anything before $Dest_Port$ and In your dropdown input there isn't the prefix; in this way you don't use the field and the search is limited to the string from the dropdown.
You should use a prefix in the dropdown input as the following

<prefix>Dest_Port="</prefix>
<suffix>"</suffix>

or in the search you shoud insert:
Dest_Port="$Dest_Port$" instead of $Dest_Port$.

Bye.
Giuseppe

Re: How to edit my XML for drop-down inputs to properly filter on expected field values?

sundareshr — Thu, 30 Jun 2016 16:42:29 GMT

Try adding fieldnames to each. Like this (adjust for correct field names)

sourcetype="udp:514" host="172.20.1.62" User="$User$" Action="$Action$" Src_IP="$Src_IP$" Dest_IP="$Dest_IP$"  Dest_Post="$Dest_Port$" URL=" $URL$" | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL

Re: How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac — Thu, 30 Jun 2016 16:50:36 GMT

Thank you!

Re: How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac — Thu, 30 Jun 2016 16:50:41 GMT

Thank you!