I have multiple sources with information for an event. I want to make a Dashboard with a total overview of all info available on a given event, but be able to select which sources are displayed. As there are many sources and not all of them always contain event data, I want a dynamic list of check boxes to get a best possible workflow.
I've attempted with a "Multiselect" field dynamically populated with ... | stats values(sourcetype) as types | mvexpand types
, but the resulting UI is quite hard to use. I see the ideal solution as a dynamic list of sources with info on the event where the user can select or deselect sources individually.
Is this possible, and how can I achieve this?
Here is an example to load Top 5 sourcetypes. Default and static choice value All may not be required. I have just added as example.
<form>
<label>Example Dashboard with Sourcetype Check Boxes</label>
<fieldset submitButton="false">
<input type="time" token="selTime" searchWhenChanged="true">
<label>Select Time</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="checkbox" token="chkSourceType" searchWhenChanged="true">
<label>Source Types</label>
<choice value="*">All</choice>
<prefix>sourcetype=</prefix>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=_internal earliest=$selTime.earliest$ latest=$selTime.latest$ |top 5 sourcetype | fields sourcetype</query>
</search>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search>
<query>index=_internal status=* $chkSourceType$ | stats count by status</query>
<earliest>$selTime.earliest$</earliest>
<latest>$selTime.latest$</latest>
</search>
<option name="charting.chart">line</option>
</chart>
</panel>
</row>
</form>
Thanks. Was looking for that part in check box input. Works with minor tweaking.