Populate server name from source field

[indeed_2000]

Hi

here is my dashboard, i want to populate server name in dashboard.

i create token to get server name from source file, here is the source file 

/data/product/customer/20210622/log.SRV21.20210622.bz2"

/data/product2/customer2/20210622/log.SRVdata21.20210622.bz2"

…

<form theme="dark">

  <label>dashboard</label>

  <fieldset submitButton="false">

    <input type="time" token="tokTime" searchWhenChanged="true">

      <label>Time</label>

      <default>

        <earliest>-1d@d</earliest>

        <latest>@d</latest>

      </default>

    </input>

    <input type="multiselect" token="tokserver">

      <label>Server Name</label>

      <choice value="*">all</choice>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

      <delimiter> OR </delimiter>

      <fieldForLabel>rexOutput</fieldForLabel>

      <fieldForValue>rexOutput</fieldForValue>

      <search>

        <query>| metadata type=sources index=main  | rex field=source "(\/\w+){4}\/(?&lt;rexOutput&gt;\w+.\w*)\S+" |search   rexOutput=$tokserver$ | dedup rexOutput | table rexOutput</query>

        <earliest>-24h@h</earliest>

        <latest>now</latest>

      </search>

      <default>*</default>

    </input>

    <input type="multiselect" token="toksig">

      <label>Signal</label>

      <choice value="*">all</choice>

      <fieldForLabel>signal</fieldForLabel>

      <fieldForValue>signal</fieldForValue>

      <search>

        <query>index="main"  signal    | search signal=$toksig$ | table _time Modules signal</query>

      </search>

      <default>*</default>

      <delimiter> OR </delimiter>

      <valuePrefix>"</valuePrefix>

      <valueSuffix>"</valueSuffix>

    </input>

  </fieldset>

  <row>

    <panel>

      <viz type="timeline_app.timeline">

        <search>

          <query>index="main"  signal  | search  source=$tokserver$  | search signal=$toksig$ | table _time Modules signal</query>

          <earliest>$tokTime.earliest$</earliest>

          <latest>$tokTime.latest$</latest>

          <sampleRatio>1</sampleRatio>

        </search>

        <option name="drilldown">all</option>

        <option name="height">430</option>

        <option name="timeline_app.timeline.axisTimeFormat">MINUTES</option>

        <option name="timeline_app.timeline.colorMode">categorical</option>

        <option name="timeline_app.timeline.maxColor">#DA5C5C</option>

        <option name="timeline_app.timeline.minColor">#FFE8E8</option>

        <option name="timeline_app.timeline.numOfBins">6</option>

        <option name="timeline_app.timeline.tooltipTimeFormat">SUBSECONDS</option>

        <option name="timeline_app.timeline.useColors">1</option>

        <option name="trellis.enabled">0</option>

        <option name="trellis.scales.shared">1</option>

        <option name="trellis.size">medium</option>

      </viz>

    </panel>

  </row>

</form>

[venkatasri]

Hi @indeed_2000 can you update your query, 

| metadata type=sources index=main  | rex field=source "(\/\w+){4}\/(?<rexOutput>\w+.\w*)\S+" | dedup rexOutput | fields rexOutput

---

An upvote would be appreciated and Accept solution if it helps!

[venkatasri]

You have to to do one more update to multiselect token,

<prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>source="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>

Change the following query to -

index="main"  signal  $tokserver$  | search signal=$toksig$ | table _time Modules

[venkatasri]

@indeed_2000  total 3 changes to dashboard.

--

An upvote would be appreciated and Accept the solution if it helps!