topic Re: Setting search term based on dropdown selection in dashboard in Dashboards & Visualizations

Setting search term based on dropdown selection in dashboard

iceburg47 — Mon, 06 Apr 2015 21:36:29 GMT

I have a dashboard with thre saved searches for three server environments. The searches only differ based on which environment the search matches. What I want to do is make it so that a dropdown can be used to set a search term to specify the environment to search against rather than having a separate saved search for each environment. The environment an entry came from is determined by a substring of the host name that exists for test or beta environments but not production.

For example I would want to set the following search terms based on the selected value

Test is selected: "host=*Test*"
Beta is selected: "host=*Beta*"
Test is selected: "NOT host=*Test* NOT host=*Beta*"

I can probably do the matching more efficiently, but that's another mater.

Here is what my current saved search looks like for the test environment:

source="C:\\Logs\\*.log"
     host=*Test* 
     level=Error 
|cluster showcount=t field=ExceptionStackTrace t=0.9 
|  sort - cluster_count 
|  table ExceptionType ExceptionMessage ExceptionStackTrace cluster_count

How can I make my search reference the selected dropdown value?

I created dropdown with the following XML:

<input type="dropdown" token="_environmentSelected" searchWhenChanged="true">
    <label>Environment</label>
    <choice value="host=*UTT*">Test</choice>
    <choice value="host=*UTS*">Stage</choice>
    <choice value="NOT host=*UT*">Production</choice>
</input>

How do I reference the selected dropdown value in the search?

Re: Setting search term based on dropdown selection in dashboard

dolivasoh — Mon, 28 Sep 2020 19:25:50 GMT

Use tokens, See in your XML above it says token="_environmentSelected" so in your search where you want the string to appear just place $_environmentSelected$

Re: Setting search term based on dropdown selection in dashboard

iceburg47 — Mon, 06 Apr 2015 21:38:32 GMT

P.S. I'm not sure why "5." is appearing in two of my code snippets. Please ignore that.

Re: Setting search term based on dropdown selection in dashboard

iceburg47 — Mon, 06 Apr 2015 21:40:18 GMT

Thank you so much. I feel rather silly, I had missed surrounding the token name with $. Thanks again!

Re: Setting search term based on dropdown selection in dashboard

dolivasoh — Tue, 07 Apr 2015 17:28:47 GMT

No Problem. Happy Splunking!