Dynamic drop down from field values

[mahesh27]

Logs are in JSON format and we want to get this attribute.app.servicecode field values as a drop down in classic dashboard.

Query: index=application-idx  |stats count by attribute.app.servicecode

How to get this field values in a drop down????

[tej57]

Hello @mahesh27,

Ideally attribute.app.servicecode should populate the dropdown. However, for simplified usage, you can use either rename or spath command to give a simple field name for use in the dashboard. Your XML input should look something like below:

<fieldset submitButton="false">
    <input type="dropdown" token="service_code_token">
      <label>Service Code</label>
      <fieldForLabel>service_code</fieldForLabel>
      <fieldForValue>service_code</fieldForValue>
      <search>
        <query>index=application-idx |rename "attribute.app.servicecode" as service_code |stats count by service_code | fields service_code</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
</fieldset>

After setting the input, to use the selected service_code value in subsequent panels, you can mention 

| search service_code="$service_code_token$"

OR

| search "attribute.app.servicecode"="$service_code_token$"

Thanks,
Tejas.

---

If the above solution helps, an upvote is appreciated.

[mahesh27]

Hi @tej57 , thank you for sharing the code, it's working but when we run this query we see we getting field values as "Null"

Eg:

Service.app.116

Service.ast.24

Service.srt.22

Null

Is there a chance to rename this null as non-servicecode.

[tej57]

Hello @mahesh27,

You can write an eval condition to rename the NULL value as whatever string you wish.

| eval service_code=if(service_code="NULL","Non-Servicecode",service_code)

 Just append the above eval condition to your SPL query and it should work. 

Thanks,
Tejas.

[mahesh27]

Hi @tej57, I tried below Evan condition its working when I run it in a search but when I add in the xml code it’s showing in the dropdown but values are not populating on the panels.

[tej57]

Hello @mahesh27,

Can you share your XML source code and that can help understand why the input isn't working as required?

Thanks,
Tejas. 

[mahesh27]

Hi @tej57 , pls find the xml below.

<form version="1.1" theme="light">
    <label>Dashboard</label>
    <fieldset submitButton="false">
        <input type="time" token="timepicker">
            <label>TimeRange</label>
            <default>
                <earliest>-15m@m</earliest>
                <latest>now</latest>
            </default>
        </input>
        <input type="dropdown" token="servicecode">
            <label>Code</label>
            <choice value="*">All</choice>
            <default>*</default>
            <fieldForLabel>service_code</fieldForLabel>
            <fieldForValue>service_code</fieldForValue>
          <search>
              <query>
                  index=application-idx |rename "attribute.app.servicecode" as service_code | eval service_code=if(service_code="NULL","Non-Servicecode",service_code) |stats count by service_code | fields service_code              </query>
          </search>
    </input>
    </fieldset>
    <row>
        <panel>
            <table>
                <title>Incoming Count &amp; Total Count</title>
                <search>
                    <query>
                        index=application-idx AND attribute.app.servicecode="$servicecode$"
                        source=application.logs 
                       |stats count                        
                       
                    </query>
                    <earliest>timepicker.earliest</earliest>
                    <latest>timepicker.latest</latest>
                    <sampleRatio>1</sampleRatio>
                </search>
                <option name="count">20</option>
                <option name="dataOverlayMode">none</option>
                <option name="drilldown">none</option>
                <option name="percentageRow">false</option>
                <option name="refresh.display">progressbar</option>
                <option name="rowNumbers">false</option>
                <option name="totalsRow">false</option>
                <option name="wrap">true</option>
            </table>
        </panel>
    </row>
<form>