I have below search which has a CSV input (example host and category)
host server1 server2 server3 server4 server5
Catagory AP NA NA EU AP
Now I have below search which gives output
|inputlookup Messaging_Servers.csv | join type=outer max=0 host [ search sourcetype=domino-stats "Platform.Memory.RAM.TotalMBytes" ]
| join type=outer max=0 host [ search sourcetype=domino-stats "Http.Workers" ]
|table host Platform_Memory_RAM_TotalMBytes Http_Workers |dedup host
Now I would like to have a drop-down form, and if I select AP
then only server 1
and server 5
output should be shown in the dashboard with Platform_Memory_RAM_TotalMBytes
and Http_Workers
values.
In the Dashboard screen select Edit -> Edit Panels in the dropdown item select Edit Input and edit the token field in your search, replace the value you want for $ token $.
Dropdown Title </ label>
</ Input>
</ Label>
The answer is to use a token in your panel search that points to your dropdown. This is very easy to do. Please see http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/tokens