How to display table headers based on form input?

[john_dagostino]

I'm looking for a way to display a table based on a dropdown input in a dashboard. For example, if I choose "ASA" as the sourcetype, I want the table to only display the fields _time, host, src dest but if I choose "Infoblox" then I want the table to display _time, dhcpresponse, dnsquery, etc. Is there a way to do this in simple XML?

[woodcock · Accepted solution]

Do it like this:

<fieldset>
<input type="dropdown" token="fields_by_sourcetype_token">
  <label>Fields by Sourcetype</label>
  <choice value="_time host src dest ">ASA</choice>
  <choice value="_time dhcpresponse dnsquery">Infoblox</choice>
  <default>ASA</default>
</input>

Then do this:

<searchString>Blah BLAH BlAh | table $fields_by_sourcetype_token$</searchString>

[john_dagostino]

You rock!