Dashboards & Visualizations

lable and value in dropdownlist for dynamic load

Jasmine
Path Finder

 

 <input type="dropdown" token="envtoken">
      <label>env</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(match(host, ".*tv*."), "Test", 
                     match(host, ".*qv*."), "QA",
                     match(host, ".*pv*."), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
					 

 

dropdownlist binding with TEST, QA and PROD

In QA and prod have 3 host. If i select QA from dropdown list , will the search includes from all the three hosts? could you plase confirm

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Jasmine - Use like instead of match function.

| eval label=case(like(host, "%tv00.test.net"), "Test", 
                     like(host, "%qv00.qa.net"), "QA",
                     like(host, "%pv00.prod.net"), "Prod")

 

I hope this helps!!!

0 Karma

Jasmine
Path Finder

i have replaced with like.. but it search from one host only. as i mentioned in QA i have 3 hosts and Prod i have 3 hosts. i have used dedup label to avoid duplicate in drop down list . but search result containes only from one host. not from all the 3 hosts if i select QA or PROD. please advise.

 

 <input type="dropdown" token="envtoken">
      <label>env</label>
     <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>(host=</prefix>
      <suffix>)</suffix>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(like(host, "%tv00.test"), "Test", 
                     like(host, "%qv00.qa"), "QA",
                     like(host, "%pv00.prod"), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

That's correct because label has to be unique, in this case it will not generate unique label.

I would suggest set the label as well with host field, because host name already tells you whether its QA or Prod or Dev.

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...