Hi all ,
I have a search which uses a lookup datacentre.csv that has fields country start, hour, end hour, and I want to generate a drop-down list in my dashboard based on the country names present in the lookup file.
Can some one help please?
source="C:\\Budapest Router1full.csv" host="SEZ00VVM-153" sourcetype="csv" date_wday!=saturday AND date_wday!=sunday| rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth |where date_hour>=start_hour AND date_hour<= end_hour | eval Intraffic=IN/1048576 |timechart span=1h perc95(Intraffic) AS 95thPercentile ,values(receivebandwidth) as MAXIN-Bandwidth
You can have following for your dropdown code in your dashboard.
<input type="dropdown" token="country" searchWhenChanged="true">
<label>Year</label>
<choice value="*">All</choice>
<search>
<query>| lookup datacentre.csv | stats count by country</query>
</search>
<fieldForLabel>country</fieldForLabel>
<fieldForValue>country</fieldForValue>
<default>*</default>
</input>
Now change your search like this to use the token
source="C:\\Budapest Router1full.csv" host="SEZ00VVM-153" sourcetype="csv" date_wday!=saturday AND date_wday!=sunday| rex field=source "(?<country>.*?)$" | search country="$country$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth |where date_hour>=start_hour AND date_hour<= end_hour | eval Intraffic=IN/1048576 |timechart span=1h perc95(Intraffic) AS 95thPercentile ,values(receivebandwidth) as MAXIN-Bandwidth
Simply supply a search with the lookup as the search that powers the "Dynamic options" for the dropdown and select the fields for label and value appropriately.
I am sure the markup messed up your search, please post it as code and not as raw text (with the little icon above the text field for example).