I am trying to create a utility using the metadata command that will allow me to see what sourcetypes exist by index. I have started with a command that returns all the sourcetypes for an index i enter into the search, but i am trying to create a report where i can select the index from a dropdown. my search thus far looks like this:
[|metadata type=sourcetypes index="$index$" | search totalCount>0 | rename totalCount as Count recentTime as "Last Update" | table sourcetype Count "Last Update" | fieldformat Count=tostring(Count, "commas") | fieldformat "Last Update"=strftime('Last Update', "%c")]
above that in the XML, fieldset, i have put in this but it doesnt seem to return any values.
< fieldset >
< input type="dropdown" token="$index$" >
< label>Select Index</label >
< choice search="index=main">Main</choice >
< choice search="index=iis">IIS</choice >
< /input >
< /fieldset >
The entire search works when I dont have "$index$" in the search, but i am trying to dynamically be able to change that value from the dropdown
As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"
which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..
Please mark it as an answer as it's the solution:)
Thank you, i think that got it working now
As you mentioned in the choice parameter Main will be equal to "index=main". But your search definition is [|metadata type=sourcetypes index="$index$"
which leads to :
[|metadata type=sourcetypes index="index=main"!!!
is it correct? do replace it by only "main" and check..