Dropdown variables

[DTERM]

Let's say I have the following query:

index=myapp supportgroup=$supportgroup$ | top productName

where some value will be substituted for $supportgroup$, for example helpdesk, or HR, etc...

I need help populating the searchTemplate and populatingSearch tags for a dropdown I'm working on. I only need help with those two lines. The rest of the dropdown works fine.

Here's what I have.

<searchTemplate>index=myapp supportGroup=$supportGroup$ | top productName </searchTemplate>

<populatingSearch fieldForValue="supportGroup" fieldForLabel="supportGroup"><![CDATA[index=myapp supportGroup | top productName ]]></populatingSearch>

Those lines are not producing the desired output based on my search above. Please help. Thanks in advance.

[sideview · Accepted solution]

well with that <populatingSearch> you're telling it to run

index=myapp supportGroup | top productName

and then in those search results, look for a 'supportGroup' field. But there wont be a supportGroup field there.

Also, note that top by default will only return the top 10 values.

You probably want

index=myapp supportGroup | stats count by supportGroup

or

index=myapp supportGroup | top 100 supportGroup