limiting columns of statistics table and search within

[jdepp]

I am trying to create a panel with a statistics table to render the results of a search and only want specific fields to display & I am not sure how to reduce the search string to do that. Also is it possible to create a search within the table itself to search if a value is present for a specific value in that table.

sourcetype="data.newIndex.stats" clientId="100"

this produces a table with 6 column fields: Column A, Column B, Column C, Column D, Column E. I only want to display the values Column A, Column B and also allow a user to search for a value within column A from within the panel.

[vasanthmss]

Hi,

you can select what are all the fields required to display in your table using fields command. for more read this Doc

sourcetype="data.newIndex.stats" clientId="100" | fields ColumnA, ColumnB ....

coming back to your second query, search by Column A: you can use the inputtype to define the list of Column A values and user can choose any of the values. More details read this Doc

it will be,

1. Define your available list of Column A values in a dropdown by writing one search like, [sourcetype=.... clientId="100" | stats count by ColumnA]. here you can mention label field and value field from your query(here both are ColumnA). user selection will be hold by a token. say for example your token name is "columnA" that holds the user selection.
2. Your search query will take the token as input and will return the results as per user selection. like [sourcetype=... clientid="100" ColumnA="$columnA$" | fields columnA, columnB]

Accept this answer if its helpful to you.

Cheers!