Complete search string based on a drop down

[nebel]

Hi,

lets say I have a drop down with "red" and "green".
If I choose red the search should look like:

index=red | top red_user

If I chosse green the search should look like:

index=green | top green_user

Normally it is not a problem to use the token from the drop down in a search, but how can I handle it if the complete search should changing after choosing a field in the drop down?

Thank you

Regards

[lguinn2 · Accepted solution]

Create a macro for each case. In the drop-down, put the name of the macro for the value that corresponds to each choice.

The search template then could be

<searchtemplate>
    `$var$`
</searchtemplate>

That's the best that I can come up with. Plus it gives you the flexibility to change the macro without changing the dashboard.

[nebel]

thank you very much!

[lguinn2]

The token is substituted into the search string. So if the token is $var$, you could simply put it in the search template (of the XML) as

<searchTemplate>
    index=$var$ | top $var$_user
 </searchTemplate>

This should work...

[nebel]

does nobody know how I can change the full search string by choosing a field in a drop down?

[nebel]

Hi,

this was just an easy example, my searches are more complicated with regex and stuff. I think I have to replace the complete search based on the drop down.

Thank you

Regards