Hi
I have a dashboard, my requirement is like when a user will select a value Splunk in a multi-select, my pannel quey will search field=$token_of_multiselect$ or field="*report*" or field="*dashboard*".
By default my panel query is taking field="*splunk*" I wanted to add an OR condition to it so that when token value will be selected as splunk, it should add report and dashboard.
Example:
On below, component is returning Splunk and some other process value.
index=abcde sourcetype=efghi (description="*$token_of_multiselect$*" OR description_1="*$token_of_multiselect$*")
above is my pannel query with some table in it, so when I will have Splunk selected on component, I want my query like below.
index=abcde sourcetype=efghi (description="*splunk*" OR description_1="*splunk*" OR description="*report*" OR description_1="*dashboard*" )
Please write sample code in answer.
Are you looking for this?
<input type="dropdown" token="smile">
<label>Dropdown</label>
<choice value="*">All</choice>
<choice value="A,B,C,D,E">Hey</choice>
<choice value="F,G,H,I,J,K">Hello</choice>
</input>
index=myindex [| makeresults | eval value="$smile$" | makemv value delim="," | mvexpand value | eval field_1="*".value."*",field_2="*".value."*" | fields field_1, field_2 | format] | REST OF THE SEARCH
Are you looking for this?
<input type="dropdown" token="smile">
<label>Dropdown</label>
<choice value="*">All</choice>
<choice value="A,B,C,D,E">Hey</choice>
<choice value="F,G,H,I,J,K">Hello</choice>
</input>
index=myindex [| makeresults | eval value="$smile$" | makemv value delim="," | mvexpand value | eval field_1="*".value."*",field_2="*".value."*" | fields field_1, field_2 | format] | REST OF THE SEARCH
Thank Kamesh,
Worked for me. This is what I was looking for.
Hi,
Need some more information to understand the question exactly.
1. In the component drop-down, the data is hard-coded or generated dynamically?
2. If you can paste the drop-down XML, it would be easy to answer.
Hi Here is the query I have used in dropped down. I want to put these reports, dashboard alert, etc to the pannel when Splunk is selected in the dropdown similarly I will define something for process1 so that whenever I will select process1, my defined fields will be searched in the panel along with the token.
index=abcde sourcetype=efghi | dedup sn_number | rex field=_raw "(?process1)" | rex field=_raw "(?splunk)" | rex field=_raw "(?report)" | rex field=_raw "(?dashboard)" | rex field=_raw "(?alert)" | dedup process | table Process | eval Process=case(process=="report","Splunk", process=="dashboard","Splunk", process=="alert","Splunk",process=="splunk","Splunk",1=1,"process1") | table Process
sample:
<form>
<search id="base1">
<query>| tstats count where index=_internal by sourcetype</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<fieldset submitButton="false">
<input type="multiselect" token="multiselect1">
<label>sourcetype</label>
<fieldForLabel>label</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search base="base1">
<query>| table sourcetype | eval label=sourcetype</query>
</search>
<delimiter> OR </delimiter>
<valuePrefix>sourcetype="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="base1">
<query>where $multiselect1$</query>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Hi,
How would I pass the condition with token?