hello i want some help to understand Query used in chart panel and form , which one we are using
add a line chart panel that uses the following search.
index=_internal | timechart count
But in form we use below Query :-
a.Click Edit to open the dashboard editor.
b.Select Add Input > Dropdown.
3.Configure the input.
a.Select the input editing icon.
b.Select Dynamic options.
c.Add the following search to generate input labels and values.
index=_internal | stats count by sourcetype | eval label=sourcetype." (".count.")"
@Imjoin : Your query is not clear.Do you want to know why 2 queries?
1st query is to show the count using time chart command in the panel.
2nd query is to build the input for that dashboard.