Hello,
I have a doubt that I think it´s easy to respond, but until now, I have no results.
I want to make an query that depends on the result of a token, example:
How can I achieve this?
Thanks in advance.
Best regards.
<form>
<label>Sample</label>
<fieldset submitButton="false">
<input type="dropdown" token="selected" searchWhenChanged="true">
<label>Your Token</label>
<choice value="field.name1">Yellow</choice>
<choice value="field.name2, field.name4">red</choice>
<choice value="field.name3, field.name5, field.name6">green</choice>
<default>Yellow</default>
</input>
</fieldset>
<row>
<panel>
<title>|stats count by $selected$</title>
<single>
<search>
<query>|makeresults |eval tokenvalue="$selected$"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</form>
Hi,
This can be achieve by a simple token you can use refer the below sample.
Description:
Token named "token" can be set to the search based on user selection. With this example i've used the internal index, you may want to try with your index.
Note: This sample will run only you
have access to internal index.
<form>
<label>Sample</label>
<fieldset submitButton="false">
<input type="dropdown" token="token" searchWhenChanged="true">
<label>Your Token</label>
<choice value="index=_internal | head 10 | stats c by host">host</choice>
<choice value="index=_internal | head 10 | stats c by sourcetype, host">sourcetype, host</choice>
<choice value="index=_internal | head 10 | stats c by source, host, sourcetype">source, host, sourcetype</choice>
<default>index=_internal | head 10 | stats c by host</default>
<initialValue>index=_internal | head 10 | stats c by host</initialValue>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>$token$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Thanks,
V