I have a single json event that contains a list of accounts with a Business Unit Tag. I want to create a dropdown that contains a list of Business Units so the user can see only the accounts in their Business Unit. the single record looks like this in Json format
{ [-]
accounts: [ [-]
{ [-]
BU: BU1
Id: Acct1
Name: Name1
}
{ [-]
BU: BU1
Id: Acct2
Name: Name2
}
{ [-]
BU: BU2
Id: Acct3
Name: Name3
}
I can get list of unique Business Unit names using this query
index=x | spath output=BUnit path=accounts{}.BU | stats values(BUnit)
But when I try and use the search to populate the dropdown I get a single option that is a comma seperated list i.e. "BU1,BU2"
<input type="dropdown" token="BUName">
<label>Business Unit</label>
<fieldForLabel>BUnit</fieldForLabel>
<fieldForValue>BUnit</fieldForValue>
<search>
<query>index=aws sourcetype="acctlistinfo"| spath output=BUnit path=accounts{}.BU | stats values(BUnit) | stats list(values(BUnit)) as BUnit</query>
<earliest>-4h@m</earliest>
<latest>now</latest>
</search>
</input>
Your current stats command generates a single row with a multivalued field for BU, the everything in dropdown comes in single option. Try something for your dropdown search
index=x | spath output=BUnit path=accounts{}.BU | stats count by BUnit | table BUnit
Your current stats command generates a single row with a multivalued field for BU, the everything in dropdown comes in single option. Try something for your dropdown search
index=x | spath output=BUnit path=accounts{}.BU | stats count by BUnit | table BUnit