How to dynamically populate multiselect based on dropdown in my dashboard?

[gbwilson]

I have two inputs on my dashboard, the first is a dropdown input and the second is a multiselect. The first dropdown shows a list of asset types (host, vm, pc, etc.) and the second multiselect input is a list of operating systems. When somebody clicks on on an asset type, I'd like the multiselect to populate with only operating systems for that device type.

<form>
  <label>CMS_OS_TEST2</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Asset Type</label>
      <choice value="*">ALL</choice>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>(index=cms_vm OR index=cms_host OR index=cms_pc) 
| eval sourcetype=case(sourcetype == "cms_vm", "VM", sourcetype == "cms_host", "Host", sourcetype == "cms_pc", "PC")
| table sourcetype
| dedup sourcetype</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="multiselect" token="osfield" searchWhenChanged="true">
      <label>Operating System</label>
      <fieldForLabel>OperatingSystem_Code</fieldForLabel>
      <fieldForValue>OperatingSystem_Code</fieldForValue>
      <search>
        <query>(index="cms_pc" OR index="cms_vm" OR index="cms_host"
| eval sourcetype=case(sourcetype == "cms_vm", "VM", sourcetype == "cms_host", "Host", sourcetype == "cms_pc", "PC")
| eval OperatingSystem_Code=case(sourcetype == "cms_pc", OperatingSystem_Code, sourcetype == "cms_vm", OperatingSystem_Code, sourcetype == "cms_host", OperatingSystem_Code)
| dedup OperatingSystem_Code</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <choice value="*">ALL</choice>
      <valuePrefix>OperatingSystem_Code="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR  </delimiter>
    </input>
  </fieldset>
</form>

To sum it up: when I select 'PC' for the asset type, I only want to see Operating Systems found in the PC index, so on and so forth.

[brendanmatthews · Accepted solution]

You can add sourcetype=$sourcetype$ in the query for your multiselect search, which will use the first token to search for the second.

[gbwilson]

Thanks for your help. Working well now.