Dashboards & Visualizations

Dashbaord creation single panel for two different index with their respective sourectypes

Path Finder

How do I Create a single dashboard panel with two different index and their respective source types displaying count for same field with a drop down suggesting for index selection i.e if i select a particular index from the dropdown respective count for that field is displayed and so on.

0 Karma



Check this and modify it accordingly

  <fieldset submitButton="false">
    <input type="dropdown" token="selectedindex">
      <label>Index Name</label>
        <query>| rest /services/data/indexes | dedup title | table title</query>
          <unset token="form.sourcetype"></unset>
    <input type="dropdown" token="sourcetype">
      <label>Source Type</label>
        <query>index="$selectedindex$" |stats count by sourcetype</query>
  <row depends="$sourcetype$">
          <query>index="$selectedindex$" sourcetype="$sourcetype$" |stats count by source</query>
        <option name="drilldown">none</option>
0 Karma

Path Finder

Sharing the demo query details :

index=blc_db sourcetype=prd_spark_agg_blc_nginx_access OR
index=internal_smapi_db sourcetype=prd_spark_agg_smapi_be_events_per_request
|stats count by src
| bucket _time span=1d

Please help me in modifying the query

0 Karma