I have a dashboard that is populated by an input.. It selects the index.. I am using the following search based on that to populate a dashboard:
index=internal source=*licenseusage.log type=Usage pool=* | stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
I want it to select whichever index the user chooses in the input.. So I need to use eval to make idx=$index_name$ or something to reference the right idx from the log by using the input dropdown.
If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?
First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:
<input type="dropdown" token="token_idx">
<query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
Then you can integrate the selected value by integrating the $token_idx$ token into your search:
index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
View solution in original post
Thanks exactly what I needed!