I have a drop down which populates the list of servers in the environment and the default value of the server token is * which gets all the servers and some extra as $server$=* , whereas i need * to be only the servers in the lookup. Here is my code
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="server" searchWhenChanged="true">
<label>Select a server Number:</label>
<default>*</default>
<choice value="*">All servers</choice>
<fieldForLabel>serverName</fieldForLabel>
<fieldForValue>SERVER</fieldForValue>
<search base="lookup_csv">
<query>search OPEN="Y" AND | search TimeZone=* AND Territory=* AND Region=* AND District=* AND STATE=*
| sort SERVER
| rex mode=sed field=SERVER "s/(\d+)/000\1/"
| rex mode=sed field=SERVER "s/0*([0-9]{4})/\1/"
| eval storeName = SERVER+"-"+SERVER_NAME+"-"+STATE
| table SERVER serverName</query>
</search>
As you can see, the lookup search will spit out all the servers which i require and i want the default value (* ) to be restricted to only these values(coming from lookup )
You need to filter that in the main search where the SERVER token is used
i.e. index=my_index |search [|inputlookup host_csv|additional filter|fields SERVER] | search SERVER=$SERVER$
Thanks, thats what I did and it fixed the problem.
@macadminrohit, glad that worked. You may accept it as answer to close the thread.