How to set up a drop-down box to represent 2 different variables at the same time (Multiple searches)?

[lennys26]

I have a dashboard which takes user input from an input field ($number$) and then has a drop-down box for another option (inbound or outbound). The input is then searched in two different servers, each sever requiring a slightly different search string based on the drop-down choice.

The searches are run for either Inbound OR Outbound and on BOTH servers:

server 1: 
    If Inbound: index=direama Originating_Open_Digits_1=$number$ | .......
    If Outbound:    index=direama Terminating_Open_Digits_1=$number$ | .......

server 2: 
    If Inbound: index="genband-cdr" S3_called_party_ondest=$number$ | .......
    If Outbound:    index="genband-cdr" S3_ani=$number$ | .......

I was trying to use the drop-down box to represent the search string (Originating_Open_Digits_1, S3_called_party_ondest, etc), but this didn't work because I would have send a different strings for each server.

What I can't figure out is how to either:

1. Get the variable to 'represent' 2 different search terms (or entire searches); OR
2. The more ugly way to do it is to feed both terms into both searches and use an OR to get them to run.

Any ideas on how to set this up?

[chimell]

Hi lennys26
Can you post me your dashboard xml code ?
i don't understand well your problem

[stephanefotso]

I think the INPUT Multi-token Setter in dashboard 6.x example app should help you. Something like the one bellow. Take a look at it and let me know if you have any issue

<input type="dropdown" token="level">
        <label>Log Level:</label>
        <choice value="ANY">ANY</choice>
        <choice value="ERROR">ERROR</choice>
        <choice value="WARNING">WARNING</choice>
        <choice value="INFO">INFO</choice>
        <default>ANY</default>
        <change>
          <condition value="ANY">
            <set token="new_search">index=_internal sourcetype=splunkd | table _time sourcetype message</set>
          </condition>
          <condition value="*">
            <set token="new_search">index=_internal sourcetype=splunkd | table _time source sourcetype message</set>
          </condition>
        </change>
      </input>

      <table>
        <title></title>
        <search>
          <query>$new_search$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">5</option>
      </table>