Have you tried adding the token from your dropdown to your base search?
I made a quick dashboard using makeresults to illustrate the concept:
<form> <label>testdash</label> <search id="primary"> <query>|makeresults count=100 | eval logtype = random()%5 | eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", ""))))) | search $dynamic_dropdown$ </query> <earliest>-24h@h</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <fieldset submitButton="true" autoRun="true"> <input type="dropdown" token="dynamic_dropdown" searchWhenChanged="true"> <label>Animal Types</label> <choice value="dynamic_field=*">all</choice> <default>dynamic_field=*</default> <initialValue>dynamic_field=*</initialValue> <fieldForLabel>dynamic_field</fieldForLabel> <fieldForValue>value</fieldForValue> <search> <query>|makeresults count=100 | eval logtype = random()%5 | eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", ""))))) | dedup dynamic_field | sort dynamic_field | eval value="dynamic_field=".dynamic_field</query> </search> </input> </fieldset> <row> <panel> <single> <search base="primary"> <query>|stats count</query> </search> <option name="drilldown">none</option> </single> </panel> </row> </form>
Let me break it down:
<search id="primary"> defines your base search. This search will populate all of your other panels based on this high level search.
Typically this search will look something like:
index=your_index sourcetype=your_sourcetype source=your_source | fields field1 field2 field3
You call on this search by adding
<search_base="primary"> to any panel that would would like to build on from the base search.
You can see an example of this in the dashboard above:
<search base="primary"> <query>|stats count</query> </search>
Notice how the
<query> is very small, that's because it's taking the base search as a starting point and adding onto it.
Lastly, notice in the example dashboard I've added
|search $dynamic_dropdown$ to my base search. This is a reference to the token that dynamically populates the dropdown with the values from my search. Without this, your dropdown won't have any effects on your dashboard.
The only other thing I can think of to add is the
searchWhenChanged="true" option. If you would like your dashboard to only populate when the submit button is pushed, change this to
Hopefully this helps.