lable and value in dropdownlist for dynamic load

[Jasmine]

 <input type="dropdown" token="envtoken">
      <label>env</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(match(host, ".*tv*."), "Test", 
                     match(host, ".*qv*."), "QA",
                     match(host, ".*pv*."), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>
					 

dropdownlist binding with TEST, QA and PROD

In QA and prod have 3 host. If i select QA from dropdown list , will the search includes from all the three hosts? could you plase confirm

[VatsalJagani]

@Jasmine - Use like instead of match function.

| eval label=case(like(host, "%tv00.test.net"), "Test", 
                     like(host, "%qv00.qa.net"), "QA",
                     like(host, "%pv00.prod.net"), "Prod")

I hope this helps!!!

[Jasmine]

i have replaced with like.. but it search from one host only. as i mentioned in QA i have 3 hosts and Prod i have 3 hosts. i have used dedup label to avoid duplicate in drop down list . but search result containes only from one host. not from all the 3 hosts if i select QA or PROD. please advise.

 <input type="dropdown" token="envtoken">
      <label>env</label>
     <fieldForLabel>label</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>(host=</prefix>
      <suffix>)</suffix>
      <search> <query>
index=aaa (source="/var/log/testd.log")
|stats count by host 
| eval label=case(like(host, "%tv00.test"), "Test", 
                     like(host, "%qv00.qa"), "QA",
                     like(host, "%pv00.prod"), "Prod")| dedup label</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>

[VatsalJagani]

That's correct because label has to be unique, in this case it will not generate unique label.

I would suggest set the label as well with host field, because host name already tells you whether its QA or Prod or Dev.

I hope this helps!!!