hi all,
I am trying to create a dropdown with 3 different source types to display a graph per source type.
If I try to change the source type, the graph doesn't show up.
In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards
and can't be renamed to a single value. i.e. rename *something as otherthing
wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this
Changes are highlighted by comments
<form>
<label>Drilldown</label>
<fieldset submitButton="false">
<input type="time" token="field1" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Select Host</label>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
<choice value=""usac2-photos01.example.com-too_small"">"usac2-photos01.example.com-too_small"</choice>
<choice value=""usac2-photos02.example.com-too_small"">"usac2-photos02.example.com-too_small"</choice>
<choice value=""usac2-photos03.example.com-too_small"">"usac2-photos03.example.com-too_small"</choice>
</input>
</fieldset>
<row>
<panel>
<title>Photos Count of Url Hits</title>
<chart>
<search>
<!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
<query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)"
| timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0
<!-----------COMMENT : Substituted tokens in the rename ---------->
| rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
| eval "totalhits" = jp_200_hits+jp_404_hits
| table _time jp_200_hits jp_404_hits totalhits</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
</chart>
</panel>
</row>
</form>
In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards
and can't be renamed to a single value. i.e. rename *something as otherthing
wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this
Changes are highlighted by comments
<form>
<label>Drilldown</label>
<fieldset submitButton="false">
<input type="time" token="field1" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>0</earliest>
<latest></latest>
</default>
</input>
<input type="dropdown" token="host" searchWhenChanged="true">
<label>Select Host</label>
<search>
<query/>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
<choice value=""usac2-photos01.example.com-too_small"">"usac2-photos01.example.com-too_small"</choice>
<choice value=""usac2-photos02.example.com-too_small"">"usac2-photos02.example.com-too_small"</choice>
<choice value=""usac2-photos03.example.com-too_small"">"usac2-photos03.example.com-too_small"</choice>
</input>
</fieldset>
<row>
<panel>
<title>Photos Count of Url Hits</title>
<chart>
<search>
<!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
<query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)"
| timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0
<!-----------COMMENT : Substituted tokens in the rename ---------->
| rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
| eval "totalhits" = jp_200_hits+jp_404_hits
| table _time jp_200_hits jp_404_hits totalhits</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
</chart>
</panel>
</row>
</form>