- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a dashboard that is populated by an input.. It selects the index.. I am using the following search based on that to populate a dashboard:
index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
I want it to select whichever index the user chooses in the input.. So I need to use eval to make idx=$index_name$ or something to reference the right idx from the log by using the input dropdown.
Any thoughts?
Thanks,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![DMohn DMohn](https://community.splunk.com/legacyfs/online/avatars/336305.jpg)
If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx
?
First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:
<input type="dropdown" token="token_idx">
<label>IDX</label>
<search>
<query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
</search>
<fieldForLabel>idx</fieldForLabel>
<fieldForValue>idx</fieldForValue>
</input>
Then you can integrate the selected value by integrating the $token_idx$
token into your search:
index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![DMohn DMohn](https://community.splunk.com/legacyfs/online/avatars/336305.jpg)
If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx
?
First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:
<input type="dropdown" token="token_idx">
<label>IDX</label>
<search>
<query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
</search>
<fieldForLabel>idx</fieldForLabel>
<fieldForValue>idx</fieldForValue>
</input>
Then you can integrate the selected value by integrating the $token_idx$
token into your search:
index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks exactly what I needed!
![](/skins/images/53C7C94B4DD15F7CACC6D77B9B4D55BF/responsive_peak/images/icon_anonymous_message.png)