I have a dropdown with two values PROD and TEST. Based on my selection in my panels in the dashboard I have to choose a different index for my search. How can I do this?
Example of two searches: (which also includes other tokens. These can be ignored. Both searches work if I directly put in the right index
1/
index=<IF PROD then AAA_prod_index else AAA_test_index> sourcetype IN (abc:edge:api, abc:edge:api) proxy!="ow*" $client_token$ $target_token$ |
rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy
2/
index=<IF PROD then BBB_prod_index else BBB_test_index> sourcetype=accesslog tenant=$tenant_token$ | stats count by HTTPStatusCode
Your dropdown token, for example
<input type="dropdown" token="environment">
<label>Environment</label>
<choice value="prod">PROD</choice>
<choice value="test">TEST</choice>
</input>
...
and then the searches just use that token
index=AAA_$environment$_index sourcetype IN (abc:edge:api, abc:edge:api) proxy!="ow*" $client_token$ $target_token$ |
rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy
----
index=BBB_$environment$_index sourcetype=accesslog tenant=$tenant_token$ | stats count by HTTPStatusCode
Thx that worked fine
Please mark the answer as a solution for others to benefit from - thanks
Your dropdown token, for example
<input type="dropdown" token="environment">
<label>Environment</label>
<choice value="prod">PROD</choice>
<choice value="test">TEST</choice>
</input>
...
and then the searches just use that token
index=AAA_$environment$_index sourcetype IN (abc:edge:api, abc:edge:api) proxy!="ow*" $client_token$ $target_token$ |
rex mode=sed field=proxy "s#^(.*?)_(.*)$#*_\2#" | stats count by proxy
----
index=BBB_$environment$_index sourcetype=accesslog tenant=$tenant_token$ | stats count by HTTPStatusCode