drop down populating the search

[DTERM]

I want to populate a dropdown search with the following results:

index=myapp | top tgtHostname | fields tgtHostname

So the dropdown will only have the top 10 fields designatd as tgtHostname

here is my code.

<populatingSearch fieldForValue="tgtHostname" fieldForLabel="tgtHostname">| metadata type=tgtHostname index=myapp</populatingSearch>

Why does that not work? The drop down is visually there but it does not contain the list generated by the query.

Thanks.

[rroberts · Accepted solution]

You need two searches.
The second actually populates the selection box.

Simple select drop down

<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>

<fieldset>
    <!-- Define a simple dropdown form driven by a search -->
    <input type="dropdown" token="series">
        <label>Select series</label>
        <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series]]></populatingSearch>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<row>
    <!-- output the results as a 50 row events table -->
    <table>
        <title>Matching events</title>
        <option name="count">50</option>
    </table>
</row>

[DTERM]

got thanks....

[DTERM]

I think I have that. The query itself is not giving me the desired results.

Perhaps the better question would be, how to take this query

index=myapp | top tgtHostname | fields tgtHostname

ans place it in the populatingSearch tag?

Thank you.