topic Re: drop down populating the search in Dashboards & Visualizations

drop down populating the search

DTERM — Thu, 01 Sep 2011 15:47:07 GMT

I want to populate a dropdown search with the following results:

index=myapp | top tgtHostname | fields tgtHostname

So the dropdown will only have the top 10 fields designatd as tgtHostname

here is my code.

<populatingSearch fieldForValue="tgtHostname" fieldForLabel="tgtHostname">| metadata type=tgtHostname index=myapp</populatingSearch>

Why does that not work? The drop down is visually there but it does not contain the list generated by the query.

Thanks.

Re: drop down populating the search

rroberts — Thu, 01 Sep 2011 16:01:33 GMT

You need two searches.
The second actually populates the selection box.

Simple select drop down

<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select series</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

Re: drop down populating the search

DTERM — Thu, 01 Sep 2011 16:15:24 GMT

I think I have that. The query itself is not giving me the desired results.

Perhaps the better question would be, how to take this query

index=myapp | top tgtHostname | fields tgtHostname

ans place it in the populatingSearch tag?

Thank you.

Re: drop down populating the search

DTERM — Thu, 01 Sep 2011 18:50:43 GMT

got thanks....