Regex Help: How to search all events with the selected values from two drop-downs on my dashboard?

[alan20854]

Hi,

I am creating a dashboard with 2 drop-downs, one for Services and the other for Methods, and I want the search to look for all events with the selected Service and Method.

However, the values in the drop-downs do not perfectly match what I am looking for. For example, one of the services in the drop-down may show - Enrollment Web Service (NRLMT_WS) and the method may be - Get Enrollments (GET_NRLMT) , but in my search , I want to look for all events where Service = NRLMT_WS AND Method = GET_NRLMT.

Considering that all the options in the drop-downs are in this format: their description and then its key phrase in parentheses, what is the search for this?

Thanks

[woodcock · Accepted solution]

The description of your dropdown can be different from the string value of that goes into the associated token. So have the description be Enrollment Web Service (NRLMT_WS), the token value be NRLMT_WS. Then have your search be like this:

... Service="$Service_Token$" Method="$Method_Token$"

[somesoni2]

Try this for your service and method dropdown (rest all same)

 <input type="dropdown" token="service1" searchWhenChanged="true">
   <label>Service</label>
   <search>
     <query>| inputlookup Lookup.csv | search source="$source1$" | stats count by service | table service | rex field=service "\((?<service_value>[^\)]+)\)" </query>
   </search>
   <fieldForLabel>service</fieldForLabel>
   <fieldForValue>service_value</fieldForValue>
 </input>
 <input type="dropdown" token="method1" searchWhenChanged="true">
   <label>Method/Operation</label>
   <search>
     <query>| inputlookup Lookup.csv | search (source = "$source1$" AND service = "*($service1$)")| stats count by method | table method | rex field=method "\((?<method_value>[^\)]+)\)" </query>
     <earliest>0</earliest>
   </search>
   <fieldForLabel>method</fieldForLabel>
   <fieldForValue>method_value</fieldForValue>
 </input>

[somesoni2]

Do you've static values in the dropdowns OR it's being populated using a query? In both cases you can have "value" portion to use the value inside parenthesis.

Other option would be to update your panel search to do the regex/transformation of the selected value. Could you post your dashboard xml, with searches being used?

[alan20854]

Hi somesoni2,

Here is my current dashboard XML:

External Interfaces

<input type="dropdown" token="source1" searchWhenChanged="true">
  <label>Source</label>
  <search>
    <query>| inputlookup Lookup.csv | stats count by source | table source</query>
  </search>
  <fieldForLabel>source</fieldForLabel>
  <fieldForValue>source</fieldForValue>
</input>
<input type="dropdown" token="service1" searchWhenChanged="true">
  <label>Service</label>
  <search>
    <query>| inputlookup Lookup.csv | search source="$source1$" | stats count by service | table service</query>
  </search>
  <fieldForLabel>service</fieldForLabel>
  <fieldForValue>service</fieldForValue>
</input>
<input type="dropdown" token="method1" searchWhenChanged="true">
  <label>Method/Operation</label>
  <search>
    <query>| inputlookup Lookup.csv | search (source = "$source1$" AND service = "$service1$")| stats count by method | table method</query>
    <earliest>0</earliest>
  </search>
  <fieldForLabel>method</fieldForLabel>
  <fieldForValue>method</fieldForValue>
</input>
<input type="time" token="time" searchWhenChanged="true">
  <label>Last Transaction Time</label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <event>
    <title>Most Recent Event</title>
    <search>
      <query>Service = $service1$ Method = $method1$|sort -_time | head 1</query>
      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </event>
</panel>