How do you create a dropdown with 3 different source types to display a graph per source type?

[splunkuseradmin]

hi all,

I am trying to create a dropdown with 3 different source types to display a graph per source type.
If I try to change the source type, the graph doesn't show up.

[renjith_nair · Accepted solution]

@splunkuseradmin,

In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards and can't be renamed to a single value. i.e. rename *something as otherthing wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this

Changes are highlighted by comments

<form>
  <label>Drilldown</label>
  <fieldset submitButton="false">
   <input type="time" token="field1" searchWhenChanged="true">
   <label>Select Time</label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>
 <input type="dropdown" token="host" searchWhenChanged="true">
   <label>Select Host</label>
   <search>
     <query/>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
   <choice value="&quot;usac2-photos01.example.com-too_small&quot;">"usac2-photos01.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos02.example.com-too_small&quot;">"usac2-photos02.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos03.example.com-too_small&quot;">"usac2-photos03.example.com-too_small"</choice>
 </input>
  </fieldset>
  <row>
 <panel>
   <title>Photos Count of Url Hits</title>
   <chart>
     <search>
        <!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
          <query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)" 
         | timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0 
         <!-----------COMMENT : Substituted tokens in the rename ---------->
         | rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
         | eval "totalhits" = jp_200_hits+jp_404_hits
         | table _time jp_200_hits jp_404_hits totalhits</query>
                   <earliest>$field1.earliest$</earliest>
                   <latest>$field1.latest$</latest>
                   <sampleRatio>1</sampleRatio>
         </search>
       </chart>
     </panel>
</row>     
</form>