I have a few dashboards where I set up radio buttons that let the user select which host to search for. The panels each have a
host=$selectedHost at the start to constrain the search. This works well except we also have a few sourcetypes set up where some groups of hosts have been created.
I need a way on a dashboard to let the user select a specific host or select a sourcetype, but I can't think of a way to have the search in a panel do one or the other. By that I mean "(if $selectedHost!=null then host=$selectedHost) else (sourcetype=$selectedSourcetype) the rest of the search".
I suspect that there is a better way to do this in general and am looking for any tidbits on how best to select either from a list of hosts or a list of sourcetypes to constrain a search.
How about this (run anywhere example)
<form> <label>Radio</label> <fieldset submitButton="false"> <input type="radio" token="selectedFilter"> <label>Filter Selector</label> <choice value="sourcetype=splunkd">sourcetype=splunkd</choice> <choice value="source=*license_usage.log">source=*license_usage.log</choice> <default>sourcetype=splunkd</default> </input> </fieldset> <row> <panel> <event> <search> <query>index=_internal $selectedFilter$ | head 10</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="type">list</option> <option name="count">10</option> <fields>["host","source","sourcetype"]</fields> </event> </panel> </row> </form>
You can give two different drop downs and default them to
if they select host, they will leave the sourcetype at
* and if they select sourcetype they will leave host as
Does this work for your case?
The idea was helpful but I did it a little differently.
The host selector radio buttons had a field called hostVar and each one was set to a different hostname.
The change that I made was to add after each hostname value 'sourcetype=' so they look like this:
I also added a new radio button for a sourcetype selection that has a value that looks like this:
That panels already have this so the above works:
host=$hostVar$ my query
I'm not a pro at querying but the above seems to work.
tks for the suggestion