Dashboards & Visualizations

lable and value in dropdownlist for dynamic load

Jasmine
Path Finder

 

 <input type="dropdown" token="envtoken">
      <label>env</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(match(host, ".*tv*."), "Test", 
                     match(host, ".*qv*."), "QA",
                     match(host, ".*pv*."), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
					 

 

dropdownlist binding with TEST, QA and PROD

In QA and prod have 3 host. If i select QA from dropdown list , will the search includes from all the three hosts? could you plase confirm

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Jasmine - Use like instead of match function.

| eval label=case(like(host, "%tv00.test.net"), "Test", 
                     like(host, "%qv00.qa.net"), "QA",
                     like(host, "%pv00.prod.net"), "Prod")

 

I hope this helps!!!

0 Karma

Jasmine
Path Finder

i have replaced with like.. but it search from one host only. as i mentioned in QA i have 3 hosts and Prod i have 3 hosts. i have used dedup label to avoid duplicate in drop down list . but search result containes only from one host. not from all the 3 hosts if i select QA or PROD. please advise.

 

 <input type="dropdown" token="envtoken">
      <label>env</label>
     <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>(host=</prefix>
      <suffix>)</suffix>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(like(host, "%tv00.test"), "Test", 
                     like(host, "%qv00.qa"), "QA",
                     like(host, "%pv00.prod"), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

That's correct because label has to be unique, in this case it will not generate unique label.

I would suggest set the label as well with host field, because host name already tells you whether its QA or Prod or Dev.

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...