Hello,
I am attempting to create a search that utilises two drop boxes.
The first dropdown is populated from a query which lists servers
<label>Server List</label>
<description>Projects the future disk usage of all/description>
<fieldset autoRun="false" submitButton="true">
<input type="dropdown" token="Host" searchWhenChanged="true">
<label>Server Name</label>
<fieldForLabel>Host</fieldForLabel>
<fieldForValue>Host</fieldForValue>
<search>
<query>| inputlookup windows_hostmon_system | regex Host="regexgoeshere" | dedup Host</query>
</search>
<default>default server goes here</default>
<initialValue>InitialServerName</initialValue>
</input>
I then want to use the selection of the above dropdown and commit it to a token to be used in the next dropdown.
<input type="dropdown" token="Disk">
<label>Disk</label>
<fieldForLabel>Disk</fieldForLabel>
<fieldForValue>Name</fieldForValue>
<search>
<query>eventtype=hostmon_windows source=Disk host="$HostChoice$" sourcetype="Winhostmon" Name="*" | stats count(Name) by Name</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
</input>
Is it possible to capture the output of a dynamic dropdown and use that output as a variable in other dynamic dropdowns.
Kind Regards
Hi @crispb,
yes you can:
the second dropdown is a search as the ones in panels, so you have to put the token in the input's search as if they were:
eventtype=hostmon_windows source=Disk host="$Host$" sourcetype="Winhostmon" Name="*"
| stats count by Name
Ciao.
Giuseppe
Hi @crispb,
yes you can:
the second dropdown is a search as the ones in panels, so you have to put the token in the input's search as if they were:
eventtype=hostmon_windows source=Disk host="$Host$" sourcetype="Winhostmon" Name="*"
| stats count by Name
Ciao.
Giuseppe
Hello @gcusello
Thanks for the response.
I honestly must of missed that I renamed the token.
Many hours of frustration fixed by a fresh set of eyes.
Thanks for the help.
Regards
Hi @crispb,
no problem: it's an easy error 😉
The important thing is that you solved, see next time!
Ciao and happy splunking.
Giuseppe
P.S.: Karma Points are appreciated 😉