Hi All, Created a drop down for index but when i added the token value in the panel query not working as expected when i select ALL option from the drop down.
But when i select DEV_INDEX or SIT_INDEX its working fine.
How to tweak the code to show up 2 indexes data in the panel query when we select ALL option from the drop down???
<form version="1.1" theme="light">
<label>Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="timepicker">
<label>TimeRange</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="Index" searchWhenChanged="true">
<label>Indexes</label>
<choice value="dev_index, sit_index">All</choice>
<choice value="dev_index">DEV_INDEX</choice>
<choice value="sit_index">SIT_INDEX</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Total Count</title>
<search>
<query>index IN ("$index$") source=application.logs |stats count by codes</query>
<earliest>timepicker.earliest</earliest>
<latest>timepicker.latest</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentageRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<form>
When your token is expanded in your search, it becomes
index IN ("dev_index, sit_index")...so that is actually a SINGLE value, which will never match.
There are several ways, but the simplest for you is to just remove the quotes around your search definition, so
index IN ($index$)...
I tried to use as shown below:
index IN ($index$)...
but my token expanded in search its taking up as index IN (*), which is not working, can u suggest other solution.
Not sure how your token can be * as there is nothing defined like that, but you DO have a mismatch between your defined token in the input and it's use
<input type="dropdown" token="Index" searchWhenChanged="true">
where it's upper case Index and you are using it as lower case $index$