topic Re: Dynamic drop down from field values in Dashboards & Visualizations

Dynamic drop down from field values

mahesh27 — Wed, 22 May 2024 01:01:50 GMT

Logs are in JSON format and we want to get this attribute.app.servicecode field values as a drop down in classic dashboard.

Query: index=application-idx |stats count by attribute.app.servicecode

How to get this field values in a drop down????

Re: Dynamic drop down from field values

tej57 — Wed, 22 May 2024 06:18:01 GMT

Hello @mahesh27,

Ideally attribute.app.servicecode should populate the dropdown. However, for simplified usage, you can use either rename or spath command to give a simple field name for use in the dashboard. Your XML input should look something like below:

<fieldset submitButton="false"> <input type="dropdown" token="service_code_token"> <label>Service Code</label> <fieldForLabel>service_code</fieldForLabel> <fieldForValue>service_code</fieldForValue> <search> <query>index=application-idx |rename "attribute.app.servicecode" as service_code |stats count by service_code | fields service_code</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> </input> </fieldset>

After setting the input, to use the selected service_code value in subsequent panels, you can mention

| search service_code="$service_code_token$"

| search "attribute.app.servicecode"="$service_code_token$"

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.

Re: Dynamic drop down from field values

mahesh27 — Fri, 24 May 2024 18:30:24 GMT

Hi @tej57 , thank you for sharing the code, it's working but when we run this query we see we getting field values as "Null"

Eg:

Service.app.116

Service.ast.24

Service.srt.22

Null

Is there a chance to rename this null as non-servicecode.

Re: Dynamic drop down from field values

tej57 — Mon, 27 May 2024 06:55:56 GMT

Hello @mahesh27,

You can write an eval condition to rename the NULL value as whatever string you wish.

| eval service_code=if(service_code="NULL","Non-Servicecode",service_code)

Just append the above eval condition to your SPL query and it should work.

Thanks,
Tejas.

Re: Dynamic drop down from field values

mahesh27 — Mon, 27 May 2024 14:07:34 GMT

Hi @tej57, I tried below Evan condition its working when I run it in a search but when I add in the xml code it’s showing in the dropdown but values are not populating on the panels.

Re: Dynamic drop down from field values

tej57 — Tue, 28 May 2024 04:54:04 GMT

Hello @mahesh27,

Can you share your XML source code and that can help understand why the input isn't working as required?

Thanks,
Tejas.

Re: Dynamic drop down from field values

mahesh27 — Fri, 31 May 2024 15:20:22 GMT

Hi @tej57 , pls find the xml below.

<form version="1.1" theme="light"> <label>Dashboard</label> <fieldset submitButton="false"> <input type="time" token="timepicker"> <label>TimeRange</label> <default> <earliest>-15m@m</earliest> <latest>now</latest> </default> </input> <input type="dropdown" token="servicecode"> <label>Code</label> <choice value="*">All</choice> <default>*</default> <fieldForLabel>service_code</fieldForLabel> <fieldForValue>service_code</fieldForValue> <search> <query> index=application-idx |rename "attribute.app.servicecode" as service_code | eval service_code=if(service_code="NULL","Non-Servicecode",service_code) |stats count by service_code | fields service_code </query> </search> </input> </fieldset> <row> <panel> <table> <title>Incoming Count & Total Count</title> <search> <query> index=application-idx AND attribute.app.servicecode="$servicecode$" source=application.logs |stats count </query> <earliest>timepicker.earliest</earliest> <latest>timepicker.latest</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentageRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> <form>