Setting value to a variable using query??

[shri_27]

Hi All,

Is there a way to set a value to a variable using search query? Later i want to use that variable as token in child module! Please help.

Any help appreciated!

[sideview]

It sounds like you want to take a field value from search results, and use that field value as a $foo$ token in another search downstream?

If I'm right, what you're looking for is the ResultsValueSetter module. The documentation and examples page in Sideview Utils itself can tell you how to use it. "Module Documentation > The ValueSetter modules > The ResultsValueSetter module"

Here's a quick example though. The first Search finds the sourcetype with the most KB indexed, ResultsValueSetter pulls that down as $sourcetype$, and a second Search module plugs that into a search that returns the events for that sourcetype.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group=per_sourcetype_thruput | stats sum(kb) as totalKB by series | rename series as sourcetype | sort - totalKB | head 1
  ]]></param>

  <module name="ResultsValueSetter">
    <param name="fields">sourcetype</param>

    <module name="Search">
      <param name="search">index=* OR index=_* sourcetype="$sourcetype$" | head 10</param>

      <module name="Events">
        <param name="resizeMode">fixed</param>
        <param name="height">500px</param>
      </module>
    </module>
  </module>
</module>

Again though the docs and examples page gives a lot more detail.

UPDATE. As a second example. If you want to use the field value to set the default value of a TextField module, you would just rename the field, or rename the TextField, so that the two match. Here is an example. As a best practice I recommend giving form element modules the same exact name as the field they govern.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group=per_sourcetype_thruput | stats sum(kb) as totalKB by series | rename series as sourcetype | sort - totalKB | head 1
  ]]></param>

  <module name="ResultsValueSetter">
    <param name="fields">sourcetype</param>

    <module name="TextField">
      <param name="name">sourcetype</param>
      <param name="label">Sourcetype</param>
    </module>
  </module>
</module>

The reason why this works is that if any Sideview form element module ever gets a value from upstream set for it's own "name", then it tries to set itself to that value. This same trick will work thus for Pulldown, Radio, Checkboxes, Checkbox and the Tabs module.

[shri_27]

I want to use that value to set default in the child Textfield module... so how could i do this??