Hi.
with the code below, I am able to pull out data from our company's network and categorize them by region, as well as drilling down up to specific host. My only problem is, when I select for example 'APAC" in the first dropdown (token:region), the second dropdown with token $hostname$ displays the whole value of APAC as set in the condition,
<set token="hostname">toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*</set>
so, hte dropdown menu using token hostname will display "toyosu* OR ~ ...".
Is there a way for me to set to display a custom label rather than the value of the whole token? like if i select "APAC" in the first dropdown, the second dropdown will display the token value , but will display as "ALL".
index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$host_name$
TEST
<input type="time" token="_time" searchWhenChanged="true">
<label>Time range</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="region" searchWhenChanged="true">
<label>Select Region</label>
<choice value="*">All</choice>
<choice value="toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*">APAC</choice>
<choice value="metro* OR morristown* OR njr* OR njr1* OR ny* OR orange* OR secaucus* OR skillman* OR telx* OR weehawken* OR west* OR wilmington* OR ashburn* OR atlanta* OR boston* OR columbus* OR calgary* OR dcb* OR markham* OR miami* OR montreal* OR ottawa* OR southfield* OR toronto* OR vanc* OR washington* OR chicago* OR dallas* OR houston* OR kansas* OR losan* OR sanfran* OR seattle* OR bermuda* OR bogota* OR brasilia* OR buenos* OR caracas* OR lima* OR mexico* OR monte* OR rio* OR santiago* OR saop*">AMER</choice>
<choice value="abud* OR bahr* OR bucking* OR cairo* OR canning* OR capetown* OR citygate* OR dockland* OR dubai* OR dublin* OR guernsey* OR jersey-u* OR johannesburg* OR kuwait* OR lagos* OR qatar* OR riyadh* OR slough* OR telaviv* OR uae* OR zurich* OR amsterdam* OR athens* OR barcelona* OR brussels* OR budapest* OR copenhagen* OR dusseldorf* OR frankfurt* OR friesstrasse* OR geneva* OR hamburg* OR helsinki* OR istanbul* OR lisbon* OR luxembourg* OR madrid* OR milan* OR monaco* OR moscow* OR munich* OR oslo* OR paris* OR prague* OR rome* OR stockholm* OR stuttgart* OR vienna* OR warsaw* OR zurich*">EMEA</choice>
<default>*</default>
<condition label="*">
<set token="hostname">*</set>
<set token="hostname2">*</set>
</condition>
<condition label="APAC">
<set token="hostname">toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*</set>
<set token="hostname2">toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*</set>
</condition>
<condition label="EMEA">
<set token="hostname">abud* OR bahr* OR bucking* OR cairo* OR canning* OR capetown* OR citygate* OR dockland* OR dubai* OR dublin* OR guernsey* OR jersey-u* OR johannesburg* OR kuwait* OR lagos* OR qatar* OR riyadh* OR slough* OR telaviv* OR uae* OR zurich* OR amsterdam* OR athens* OR barcelona* OR brussels* OR budapest* OR copenhagen* OR dusseldorf* OR frankfurt* OR friesstrasse* OR geneva* OR hamburg* OR helsinki* OR istanbul* OR lisbon* OR luxembourg* OR madrid* OR milan* OR monaco* OR moscow* OR munich* OR oslo* OR paris* OR prague* OR rome* OR stockholm* OR stuttgart* OR vienna* OR warsaw* OR zurich*</set>
<set token="hostname2">abud* OR bahr* OR bucking* OR cairo* OR canning* OR capetown* OR citygate* OR dockland* OR dubai* OR dublin* OR guernsey* OR jersey-u* OR johannesburg* OR kuwait* OR lagos* OR qatar* OR riyadh* OR slough* OR telaviv* OR uae* OR zurich* OR amsterdam* OR athens* OR barcelona* OR brussels* OR budapest* OR copenhagen* OR dusseldorf* OR frankfurt* OR friesstrasse* OR geneva* OR hamburg* OR helsinki* OR istanbul* OR lisbon* OR luxembourg* OR madrid* OR milan* OR monaco* OR moscow* OR munich* OR oslo* OR paris* OR prague* OR rome* OR stockholm* OR stuttgart* OR vienna* OR warsaw* OR zurich*</set>
</condition>
<condition label="AMER">
<set token="hostname">metro* OR morristown* OR njr* OR njr1* OR ny* OR orange* OR secaucus* OR skillman* OR telx* OR weehawken* OR west* OR wilmington* OR ashburn* OR atlanta* OR boston* OR columbus* OR calgary* OR dcb* OR markham* OR miami* OR montreal* OR ottawa* OR southfield* OR toronto* OR vanc* OR washington* OR chicago* OR dallas* OR houston* OR kansas* OR losan* OR sanfran* OR seattle* OR bermuda* OR bogota* OR brasilia* OR buenos* OR caracas* OR lima* OR mexico* OR monte* OR rio* OR santiago* OR saop*</set>
<set token="hostname2">metro* OR morristown* OR njr* OR njr1* OR ny* OR orange* OR secaucus* OR skillman* OR telx* OR weehawken* OR west* OR wilmington* OR ashburn* OR atlanta* OR boston* OR columbus* OR calgary* OR dcb* OR markham* OR miami* OR montreal* OR ottawa* OR southfield* OR toronto* OR vanc* OR washington* OR chicago* OR dallas* OR houston* OR kansas* OR losan* OR sanfran* OR seattle* OR bermuda* OR bogota* OR brasilia* OR buenos* OR caracas* OR lima* OR mexico* OR monte* OR rio* OR santiago* OR saop*</set>
</condition>
</input>
<input type="dropdown" token="hostname" searchWhenChanged="true">
<label>Select Host for CFM</label>
<search>
<query>index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$region$ | top host</query>
<earliest>$_time.earliest$</earliest>
<latest>$_time.latest$</latest>
</search>
<fieldForlabel>host</fieldForlabel>
<fieldForValue>host</fieldForValue>
<default>$region$</default>
</input>
<input type="dropdown" token="hostname2" searchWhenChanged="true">
<label>Select Host for OSPF</label>
<search>
<query>index=nm "RPD_OSPF_NBR*" syslog_message!="*ExStart due to*" host=$region$| top host </query>
<earliest>$_time.earliest$</earliest>
<latest>$_time.latest$</latest>
</search>
<fieldForlabel>host</fieldForlabel>
<fieldForValue>host</fieldForValue>
<default>$region$</default>
</input>
Why not use tags?
We do something similar in our environment:
We assign tags based on the hostname parts of of servers, so PROD-eu1-webserver-01 gets broken into
tag=PROD
tag=eu1
tag=webserver
We now build our panels with three token drop downs for Environment, Location, Service, each with an ALL (*) option too.
You can either specify your tags in the form (if they don't change often) or load them from a populating search.
If you decide on the latter consider building a scheduled search to populate a lookup table with your various tag names, and then load the lookup when your form loads.
Why not use tags?
We do something similar in our environment:
We assign tags based on the hostname parts of of servers, so PROD-eu1-webserver-01 gets broken into
tag=PROD
tag=eu1
tag=webserver
We now build our panels with three token drop downs for Environment, Location, Service, each with an ALL (*) option too.
You can either specify your tags in the form (if they don't change often) or load them from a populating search.
If you decide on the latter consider building a scheduled search to populate a lookup table with your various tag names, and then load the lookup when your form loads.
Yes, this screams for tags
( tag=APAC, etc.)
Thanks for the reply. if i want to specify the tags in the form, what would the syntax be? I keep getting error if i use .
You create the tag definitions outside of the dashboard and then have a list of tags and then use tag=$tag_token$
in your dashboard search strings.