Hello
I have a dashboard with this search
sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" if $host$="yes" [| inputlookup windows_hosts_srv_2016.csv | fields host | format] | timechart max(Value) by host span=5m
I want to add checkbox so the defualt search will be
sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" if $host$="yes" host=* | timechart max(Value) by host span=5m
and if the client clicks on the checkbox then it will search by the first query
how it can be done ?
thanks
If the checkbox is selected then have the token value be "host=*". If it is not selected then the token should contain the subsearch. Then the query becomes
sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" $host$ | timechart max(Value) by host span=5m
Where should I add the conditions?
In the <input> element where the token is defined.
should it be something like this:
<form>
<label>Clock sync Clone</label>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-15m</earliest>
<latest>now</latest>
</default>
</input>
<input type="checkbox" token="field2">
<label>field2</label>
<choice value="yes">Check for listed hosts</choice>
<delimiter> </delimiter>
<change>
<condition value="yes">
<query>sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" $host$ | timechart max(Value) by host span=5m</query>
</condition>
<condition>
<eval token="checked_result_value">"B"</eval>
</condition>
</change>
</input>
</fieldset>
<row>
<panel>
<title>Time sync Windows servers 2016</title>
<chart>
<title>Time sync Windows servers 2016</title>
<search>
<query>sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" [| inputlookup windows_hosts_srv_2016.csv | fields host | format] | timechart max(Value) by host span=5m</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="charting.legend.placement">right</option>
<option name="height">262</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
</chart>
</panel>
</row>
<row>
<panel>
<title>Time sync Windows servers 2012</title>
<chart>
<search>
<query>sourcetype=timekeeper_status [| inputlookup windows_hosts_srv_2012.csv | fields host | format] | timechart max(offsets."0") by host</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</form>
i think im a little bit confused
I was thinking of something like this:
<input type="checkbox" token="field2">
<label>field2</label>
<choice value="yes">Check for listed hosts</choice>
<delimiter> </delimiter>
<change>
<condition value="yes">
<set token="host">[| inputlookup windows_hosts_srv_2012.csv | fields host | format]</set>
</condition>
<condition>
<set token="host">*</set>
</condition>
</change>
</input>
</fieldset>
<row>
...
</row>
<row>
<panel>
<title>Time sync Windows servers 2012</title>
<chart>
<search>
<query>sourcetype=timekeeper_status $host$ | timechart max(offsets."0") by host</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="charting.chart">line</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
i changed the query you wrote since i think there was a type
the query should be
sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" $host$ | timechart max(Value) by host span=5m
but now i have 2 issues:
1. i have 2 panels with different csv file but i want the same checkbox to change them so i think it is impossible to put the file name in the token, no ?
2. if the checkbox is unchecked then i get this query:
sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" * | timechart max(Value) by host span=5m
and it should be host=* and not just *
also, the graph is now showing dots...
1. Using 2 difference CSVs is possible, but you'll have to use 2 tokens. Set them both in the same <change> element with two <set> elements.
2. My bad. The token should be set to "host=*" if the checkbox is not selected.
Where should I set the host=*? I don’t see we configured it anywhere
what about the dots issue? Before the changes it was lines
Instead of
<set token="host">*</set>
use
<set token="host">host=*</set>
As for the dots problem, have you checked the format settings for the visualization?
its working, thanks
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.