You need two searches.
The second actually populates the selection box.
Simple select drop down
<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<!-- Define a simple dropdown form driven by a search -->
<input type="dropdown" token="series">
<label>Select series</label>
<populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series]]></populatingSearch>
<choice value="*">Any</choice>
</input>
</fieldset>
<row>
<!-- output the results as a 50 row events table -->
<table>
<title>Matching events</title>
<option name="count">50</option>
</table>
</row>
... View more
