How to create Stats count by token value?

[maned_beak]

Hello Splunkers

I have a below query, that am trying to get a count by field values, I am working on creating a dynamic dashboard that I have the below three fields as three  dropdown inputs. 
So, How can I make the token dynamic here, like when I choose only one value from one of the three dropdown inputs that value should populate on the stats command token. Thanks in advance!

index=<> sourcetype=<>
| search Type=$Token$
| search User=$Token$
| search Site=$Token$
| stats count by $Token$

[gcusello]

Hi @maned_beak,

let me understand:

• you have three dropdowns: Type, User and Site,
• you want to choose the values on the three dropdowns and use them in a search,
• then you want to choose the aggregation field using a fourth dropdown 8and a fourth token,

is this correct?

If this is your need, you have to create a dashboard containing this four dropdowns:

<fieldset submitButton="false">
    <input type="dropdown" token="Type">
      <label>Type</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>Type="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>Type</fieldForLabel>
      <fieldForValue>Type</fieldForValue>
      <search>
        <query>
          index=your_index
          | dedup Type
          | sort Type
          | table Type
          </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
    </input>
    <input type="dropdown" token="User">
      <label>User</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>User="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>User</fieldForLabel>
      <fieldForValue>User</fieldForValue>
      <search>
        <query>
          index=your_index
          | dedup User
          | sort User
          | table User
          </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
    </input>
    <input type="dropdown" token="Site">
      <label>Site</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>Site="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>Site</fieldForLabel>
      <fieldForValue>Site</fieldForValue>
      <search>
        <query>
          index=your_index
          | dedup Site
          | sort Site
          | table Site
          </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
    </input>
    <input type="radio" token="choice">
      <label>Grouping choice</label>
      <choice value="Type">Type</choice>
      <choice value="User">user</choice>
      <choice value="Site">Site</choice>
    </input>
</fieldset>

then in the dashboard panel use a search like this:

index=your_index sourcetype=your_sourcetype $Type$ $User$ $Site$
| stats count by $choice$

Ciao.

Giuseppe

[ITWhisperer]

If $Token$ holds the name of a field then the stats command would work although it seems unlikely that the searches using the same token value would result in any events being left.

The issue may be more to do with how you have defined the inputs/dropdowns for the tokens. Can you be more specific and show the SimpleXML code for these dropdowns?