Using tokens in dropdown menu to create two different results

[jialiu907]

I am wondering if there's a way to use the dropdown menu and tokens to display two different results. I am trying to have the dropdown menu have static options of "read" and "write".

Read would display this search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0
| spath output=values0 path=values{0}
| spath output=dsnames0 path=dsnames{0}
| stats  min(values0) as min max(values0) as max avg(values0) as avg by dsnames0
| eval min=round(min, 2)
| eval max=round(max, 2)
| eval avg=round(avg, 2)

Write would display this search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0
| spath output=values1 path=values{1}
| spath output=dsnames1 path=dsnames{1}
| stats  min(values1) as min max(values1) as max avg(values1) as avg by dsnames1
| eval min=round(min, 2)
| eval max=round(max, 2)
| eval avg=round(avg, 2)

The only change in the searches as you can see is just the elements in the multivalue field.

If there is a way to append the search and have it shown together, that would be helpful as well.

[ITWhisperer · Accepted solution]

Set up your dropdown so the value for read is 0 and the value for write is 1 then use the token in the search

index="collectd_test" plugin=disk type=disk_octets plugin_instance=dm-0
| spath output=values$token$ path=values{$token$}
| spath output=dsnames$token$ path=dsnames{$token$}
| stats  min(values$token$) as min max(values$token$) as max avg(values0) as avg by dsnames$token$
| eval min=round(min, 2)
| eval max=round(max, 2)
| eval avg=round(avg, 2)