my input dropdown passes the wrong value to the searchtemplate

[RiccardoV]

Hi, hi have this search template:

index=* sourcetype="$sourcetype$" | ....

the $sourcetype" value is coming from an input dropdown like this:

<input type="dropdown" token="sourcetype" id="sourcetype_input">
    <label>1. Select a sourcetype.</label>
    <choice value="*">All</choice>
    &lt;populatingSearch earliest="$earliest$" latest="$latest$" fieldForLabel="sourcetype" fieldForValue="sourcetype"&gt;| metadata type=sourcetypes index=* | fields sourcetype | sort sourcetype&lt;/populatingSearch&gt;
</input>

If I set as selected value "All" in my dashboard, the search will be:

index=* sourcetype="All" | ....

and not

index=* sourcetype="*" | ....

How can i fix this?

[gyslainlatsa]

hi RiccardoV,
don't put the " ", try like this:

<panel>
    <table>
        <title>----------------------------------</title>
    <search
       <query>
        index=* sourcetype=$sourcetype$ |.........
      </query>
    </search
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
    </table>
 </panel>

or your try this:

<panel>
      <table>
        <title>----------------------------------</title>
        <searchString>  index=* sourcetype=$sourcetype$ |.........</searchString>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
  </panel>

[RiccardoV]

Hi, thanks for your answer. And what if the sourcetype contains a blank space in its name?

index = * sourcetype=foo bar

will does it work anyway?

[gyslainlatsa]

if the sourcetype contains a blank space in its name,
try this for the general case:

index=* sourcetype=$sourcetype$ OR sourcetype="$sourcetype$"|.........

[RiccardoV]

The problem is that to this search arrived the value "All" and not the value *, I don't think that the problem can be related to the " " around $sourcetype$

[gyslainlatsa]

if the sourcetype contains a blank space in its name,
try this for the general case:

 index=* sourcetype=$sourcetype$ OR sourcetype="$sourcetype$"|.........

[woodcock]

Everything looks pretty much OK but there appears to be an extra ">" in your fieldForValue specification that is unmatched and doesn't make sense. In any case, for the purposes of validating your form, skip the poplulatingSearch stuff and just try this:

<searchString>index = * sourcetype = $sourcetype$</searchString>

[RiccardoV]

Hi, the ">" it's ok I think:

http://pastebin.com/aa8Nqx4h

where should I put the searchString you write down?

[woodcock]

Start with the most stripped-down XML that you can get to work and then start adding things in. Try starting with this:

<form>
  <label>TEST</label>
  <description>Gregg Woodcock says: Always Test</description>
  <fieldset autoRun="true" submitButton="false">
    <input type="dropdown" token="sourcetype">
      <label>Sourcetype</label>
      <choice value="*">All</choice>
      <default>All</default>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>Test panel</title>
      <searchString>index=* sourcetype=$sourcetype$</searchString>
      <earliestTime>-10d@d</earliestTime>
      <latestTime>now</latestTime>