I am using the following search to get all indexes and sourcetypes. But I am unable to add the search to a dashboard panel. XML seems to escape the text correctly but doesn't bring back any results.
| eventcount summarize=false index=* index!=_* | dedup index | fields index
| map maxsearches=100 search="| metadata type=sourcetypes index=\"$index$\" | eval retention=tostring(abs(lastTime-firstTime), \"duration\") | convert ctime(firstTime) ctime(lastTime) | sort lastTime | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\" | eval index=\"$index$\"" | rename index as "Index" "sourcetype" as "SourceType" | fields Index SourceType TotalEvents FirstEvent LastEvent
try this:
<form>
<label>test2</label>
<fieldset submitButton="false">
<input type="radio" token="index">
<label>index</label>
<choice value="\"$index$\"">all</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| eventcount summarize=false index=* index!=_* | dedup index | fields index
| map maxsearches=100 search="| metadata type=sourcetypes index=\"$index$\" | eval retention=tostring(abs(lastTime-firstTime), \"duration\") | convert ctime(firstTime) ctime(lastTime) | sort lastTime | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\" | eval index=\"$index$\"" | rename index as "Index" "sourcetype" as "SourceType" | fields Index SourceType TotalEvents FirstEvent LastEvent</query>
<earliest>-3d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
try this:
<form>
<label>test2</label>
<fieldset submitButton="false">
<input type="radio" token="index">
<label>index</label>
<choice value="\"$index$\"">all</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>| eventcount summarize=false index=* index!=_* | dedup index | fields index
| map maxsearches=100 search="| metadata type=sourcetypes index=\"$index$\" | eval retention=tostring(abs(lastTime-firstTime), \"duration\") | convert ctime(firstTime) ctime(lastTime) | sort lastTime | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\" | eval index=\"$index$\"" | rename index as "Index" "sourcetype" as "SourceType" | fields Index SourceType TotalEvents FirstEvent LastEvent</query>
<earliest>-3d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
With this query, is it possible to filter on both indexes and sourcetypes? So the above query lists all indexes and sourcetype....I have those in hundreds.
you could change/add to the input to filter, I believe.
I opened up a separate question for my filters. Thanks!
How I hide the input?
add this to the form statement
<form hideFilters="true">
Do you have the input created correctly? I added this to a dashboard panel exactly as written and added in an input for index and it seems to work just fine.
Oh, I see the data after adding the input. But do I get to display it all indexes and sourcetypes
it's seeing the | metadata type=sourcetypes index=\"$index$\"
and | eval index=\"$index$\""
as a token. Just add an input and just have it always set to *
if wanted.
I am unable to set it to "*"
Hello,
I am unsure of how to add the correct FirstEvent and LastEvent time in, but for the search in which you are looking for, I would use a tstats command similar to below to return the desired results.
To group every sourcetype by its index use the search below:
| tstats count WHERE index=* by index sourcetype
To group the sourcetypes by index use the below search:
| tstats count values(sourcetype) WHERE index=* by index
With this search it should populate your dashboard without a problem. You would just have to further investigate adding the first and last event times.
The only problem is tstats command is timebound. In order to look for all indexes and sourcetypes, I have select "All Time" which is taking lot of time to return the results.