generated field in chart

[mcaulsc]

Hi, 

I have data with field names in the format:

h00m00 h00m15 h00m30 h00m45 h01m00  .. thru h23m45

I'd like to pull the 'h' value from a drop down and use that in a chart command , so eval hh=substr('04:00:00',1,2) from the current token in the drop down should give me 04.

Then somehow chart just the h04* fields so I can focus on a specific hour as below where I hardcoded the  h04*

| chart sum(h04*) by edate

if anyone has any ideas I'd be grateful.

[ITWhisperer]

The first part before the blank lines in the search query just generates the fields you suggested. The important bits are evaluating the token in the dropdown and using the token in the chart command.

    <panel>
      <input type="dropdown" token="hour" searchWhenChanged="true">
        <label>Hour</label>
        <choice value="00:00:00">00:00:00</choice>
        <choice value="01:02:00">01:02:00</choice>
        <choice value="04:05:00">04:05:00</choice>
        <change>
          <eval token="times">"h".substr($hour$,1,2)</eval>
        </change>
      </input>
    </panel>
    <panel>
      <table>
        <search>
          <query>| makeresults 
| foreach 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 17 18 19 20 21 22 23
    [| eval _hour="&lt;&lt;FIELD&gt;&gt;"
    | eval F{_hour}="&lt;&lt;FIELD&gt;&gt;"]
| foreach F*
    [| eval name="h".&lt;&lt;FIELD&gt;&gt;."m00"
    | eval {name}=random()%10
    | eval name="h".&lt;&lt;FIELD&gt;&gt;."m15"
    | eval {name}=random()%10
    | eval name="h".&lt;&lt;FIELD&gt;&gt;."m30"
    | eval {name}=random()%10
    | eval name="h".&lt;&lt;FIELD&gt;&gt;."m45"
    | eval {name}=random()%10]
| fields - F* name _time



| chart sum($times$*)</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>