Select 1st, 2nd, and 3rd items from dropdown menu. Select from dropdown token as an array?

[KevinCamacho]

Hello, I have a dropdown menu in my dashboard as so:

 <input type="dropdown" token="gid" searchWhenChanged="true">
      <label>GID</label>
      <fieldForLabel>GID</fieldForLabel>
      <fieldForValue>GID</fieldForValue>
      <search>
        <query>index="omitted for security of company"   sourcetype="omitted for security of company" | stats count by GID | sort by - count</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

What I am trying to do is have 3 panels that will do searches based off the first 3 values in the dropdown, and then have a 4th panel that will do a search based on what the user selects from the dropdown menu. What would be the best way to go about this? My imagined ideal solution is that I can treat $gid$ as an array somehow and just select indexes, but I've been playing around with it and have been unable to get it to work. Any help would be great.

[niketn]

@KevinCamacho, How would you use the first three values in your first three panels? Would it be top 3 GIDs used in all three panels or one GID for each panel?

[KevinCamacho]

Panel 1 performs a search using the first GID. Panel 2 performs a search using the second GID. Panel 3 performs a search using the third GID.

[rjthibod · Accepted solution]

You need to use a global base search using the dropdown populating search, and then use those results to drive the panels and the dropdown menu.

The basic XML looks like this

<form>    
  <search id="search_gid_sorted_count">
   <query>
     index="omitted for security of company" sourcetype="omitted for security of company"
     | stats count by GID
     | sort -count
     | streamstats count as ID
   </query>
   <earliest>-24h@h</earliest>
   <latest>now</latest>
    <progress>
      <unset token="search_gid_sorted_count_sid"/>
    </progress>
    <done>
      <set token="search_gid_sorted_count_sid">$job.sid$</set>
    </done>
  </search>

  <fieldset>
    <input type="dropdown" token="gid" searchWhenChanged="true">
     <label>GID</label>
     <fieldForLabel>GID</fieldForLabel>
     <fieldForValue>GID</fieldForValue>
     <search base="search_gid_sorted_count"></search>
     <selectFirstChoice>true</selectFirstChoice>
     </input>
     </fieldset>
  </fieldset>

       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=1 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=2 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=3 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
       ...
    </panel>
       ...      
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" GID=$gid|s$ | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
</form>

[KevinCamacho]

Excellent, this worked perfectly for me! I have a follow up question, is there a way I could somehow extract the GID and have it put in the title for the panel? I know how to do that for the user-selected panel, but for the first 3 I don't know how to do it.

[rjthibod]

First, please accept my answer if that provided the core of what you needed.

Regarding your new request, you would have to add another invisible search where you can transpose the results and get the values from the first row.

Here is my attempt at such a search. If this works, you can reference the tokens $GID1$, $GID2$, $GID3$ in the panel titles.

   <search base="search_gid_sorted_count">
    <query>
      head 3
      | fields GID ID
      | eval ID = "GID" + ID 
      | transpose header_field=ID
    </query>
     <done>
       <set token="GID1">$result.GID1$</set>
       <set token="GID2">$result.GID2$</set>
       <set token="GID3">$result.GID3$</set>
     </done>
   </search>