Use eval to reference a $token$

[mansel_scheffel]

Hi,

I have a dashboard that is populated by an input.. It selects the index.. I am using the following search based on that to populate a dashboard:

index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

I want it to select whichever index the user chooses in the input.. So I need to use eval to make idx=$index_name$ or something to reference the right idx from the log by using the input dropdown.

Any thoughts?

Thanks,

[DMohn · Accepted solution]

If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?

First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:

 <input type="dropdown" token="token_idx">
  <label>IDX</label>
  <search>
    <query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
  </search>
  <fieldForLabel>idx</fieldForLabel>
  <fieldForValue>idx</fieldForValue>
 </input>

Then you can integrate the selected value by integrating the $token_idx$ token into your search:

 index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

[mansel_scheffel]

Thanks exactly what I needed!