topic How can I use TERM() phrases that comes from an Dashboard input field? in Dashboards & Visualizations

How can I use TERM() phrases that comes from an Dashboard input field?

Mockjin — Tue, 28 Mar 2023 14:28:50 GMT

Hi *

i am trying to search via tstats and TERM() statements. How can i use TERM() phrases that comes from an Dashboard input field?

for example

Input field= test1,test2

Output search=

| tstats
values(PREFIX(test_content=)) as test_content
where
index=testindex AND (TERM(host=test1) OR TERM(host=test2)
by _time PREFIX(host=)

Re: Dashboard with TERM() and tstats

Gr0und_Z3r0 — Tue, 28 Mar 2023 09:12:22 GMT

hi @Mockjin
assuming your field & value is like this inputfield= "test1,test2" you can do something like this

| tstats values(PREFIX(test_content=)) as test_content where index=testindex AND (TERM(host=mvindex(split(inputfield,","),0)) OR TERM(host=mvindex(split(inputfield,","),1)) by _time PREFIX(host=)

Re: Dashboard with TERM() and tstats

Mockjin — Tue, 28 Mar 2023 14:14:52 GMT

Hi @Gr0und_Z3r0 , thank you for your quick answer. When i try your idea i get the error message "unbalanced parantheses". I changed the Example Search for understanding.

Direct search without inputfield in test_dashboard:

|tstats count where index=_internal AND (TERM(name=dump) OR TERM(name=exec)) by PREFIX(name=)

Example search with _internal index and text field named inputfield in test_dashboard:

inputfield="dump,exec"

|tstats count where index=_internal AND (TERM(name=mvindex(split($inputfield$,","),0)) OR TERM(name=mvindex(split($inputfield$,","),1))) by PREFIX(name=)

Any idea why?

Re: Dashboard with TERM() and tstats

Gr0und_Z3r0 — Wed, 29 Mar 2023 10:19:32 GMT

try this way....

| tstats count where index=_internal by PREFIX(group=) | rename group= as group | eval inputfield="thruput,queue" | where group=mvindex(split(inputfield,","),0) OR group=mvindex(split(inputfield,","),1) | table group count