topic where to add token in my search string which is a join of two indexes in Dashboards & Visualizations

where to add token in my search string which is a join of two indexes

radha116 — Sat, 12 Jun 2021 20:45:49 GMT

I have a query as below

I have a table with below search string:

index="apple" | table "ID"
| join type=left ID [search index="csv"] | table "ID" "Type" "Status"
** Type is in csv index table

created a dropdown for type with token = type_filter.

On the above search string where should I include the token to function my dropdown.

Re: where to add token in my search string which is a join of two indexes

ITWhisperer — Sat, 12 Jun 2021 22:13:31 GMT

It depends on what you are trying to exclude with the token. Do you want IDs from apple with data from csv regardless of whether they have a match to the token in csv or do you want to exclude IDs from apple if they have a match to the token in a field from csv?

If you want the first case you would put the exclusion inside the join search, if you want the second case you would put the exclusion outside / after the join search.

Re: where to add token in my search string which is a join of two indexes

radha116 — Sun, 13 Jun 2021 00:58:44 GMT

Type dropdown has options fruits, vegetables. When i select fruits i want to see the table filtered with Type: fruit.

index="apple" | table "ID"
| join type=left ID [search index="csv" "$type_filter$"] | table "ID" "Type" "Status"

is the above correct

Re: where to add token in my search string which is a join of two indexes

radha116 — Sun, 13 Jun 2021 01:28:47 GMT

resolved

index="apple" | table "ID"
| join type=left ID [search index="csv" ] | table "ID" "Type" "Status" | search Type="$type_filter$"