This is what I am trying to do:
I have a time range drop down which will provide value to a dynamic populated drop down. I have tried the following but it fail saying "Invalid value "$earliest$" for time term 'earliest'"
{code}
<input type="dropdown" token="id">
<label>ID</label>
<populatingSearch fieldForValue="ID" fieldForLabel="ID">
<![CDATA[search index=login sourcetype=login_logs earliest="$earliest$" | dedup 1 ID]]>
</populatingSearch>
</input>
{code}
If I provide a string value as earliest="-2d@d" it works. But I want the drop down to populate the value in search string. Is it possible to earliest as:
If I use
I think you are close, what if you do this
<input type="dropdown" searchwhenchanged="true" token="earliest">
<choice value="-2d@d">2 days</choice>
<choice value="-3d@d">3 days</choice>
</input>
<input type="dropdown" token="id">
<label>ID</label>
<populatingSearch fieldForValue="ID" fieldForLabel="ID">
<![CDATA[search index=login sourcetype=login_logs| dedup 1 ID]]>
<earliestTime>$earliest$</earliestTime>
</populatingSearch>
</input>
Notice that I moved the $earliest$
token from within the populating search and into a separate tag.
If I use