Hi,
Is there a way to create a search on the fly based on user input?
What I have is a textfield and drop-down.
User enters something in the textfield and selects a value from the dro-pdown.
<form>
<label>Simple XML</label>
<description>My sample dashboard</description>
<fieldset submitButton="true">
<input type="text" token="searchText"></input>
<input type="dropdown" token="searchBy">
<label>Search By</label>
<choice value="1">Foo</choice>
<choice value="2">Bar</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Results</title>
<search>
<query>index=myIndex sourcetype=mySourceType Foo=$searchText$ | table Foo, Bar</query>
<earliest></earliest>
<latest></latest>
</search>
<option name="showPager">true</option>
</table>
</panel>
</row>
</form>
Let's say I am logging the following:
Foo=abcd, Bar=100
Foo=dcba, Bar=101
Foo=abcd, Bar=102
When user enters "abcd" and selects Foo from the drop-down, then I need to run a search that will be like:
index=myIndex sourcetype=mysourceType Foo=abcd | table Foo, Bar
And it should display 2 rows of data for Foo=abcd
If user enters 100 and selects Bar, then the search has to be:
index=myIndex sourcetype=mysourceType Bar=100 | table Foo, Bar
How do I do this?
Just update your panel search with this
index=myIndex sourcetype=mySourceType $searchBy$=$searchText$ | table Foo Bar
How about using
( Foo=$searchText$ OR Bar=$searchText$ )
Or, maybe you can do input selection for two drop-downs ; one for Foo and the other for Bar. Then, you can use the similar query ;
( Foo=$vaalue_foo$ OR Bar=$value_bar$ )
Just update your panel search with this
index=myIndex sourcetype=mySourceType $searchBy$=$searchText$ | table Foo Bar