Dashboards & Visualizations

Use eval to reference a $token$

mansel_scheffel
Explorer

Hi,

I have a dashboard that is populated by an input.. It selects the index.. I am using the following search based on that to populate a dashboard:

index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

I want it to select whichever index the user chooses in the input.. So I need to use eval to make idx=$index_name$ or something to reference the right idx from the log by using the input dropdown.

Any thoughts?

Thanks,

0 Karma
1 Solution

DMohn
Motivator

If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?

First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:

 <input type="dropdown" token="token_idx">
  <label>IDX</label>
  <search>
    <query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
  </search>
  <fieldForLabel>idx</fieldForLabel>
  <fieldForValue>idx</fieldForValue>
 </input>

Then you can integrate the selected value by integrating the $token_idx$ token into your search:

 index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

View solution in original post

0 Karma

DMohn
Motivator

If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?

First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:

 <input type="dropdown" token="token_idx">
  <label>IDX</label>
  <search>
    <query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
  </search>
  <fieldForLabel>idx</fieldForLabel>
  <fieldForValue>idx</fieldForValue>
 </input>

Then you can integrate the selected value by integrating the $token_idx$ token into your search:

 index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

View solution in original post

0 Karma

mansel_scheffel
Explorer

Thanks exactly what I needed!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.