Thanks for the help! ... View more

And my search query is: host = $env$ ... ... View more

I tried to do what you suggested, but it didn't seem to change my search query when I opened it up in search. Here is the XML: <input type="dropdown" token="env" searchWhenChanged="true"> <label>Environment</label> <choice value="host1 OR host2 OR host3">PROD</choice> <choice value="host1 OR host4">QA</choice> <choice value="host5">QI1</choice> <choice value="host5 OR host6">QI2</choice> <choice value="host7">QC1</choice> <change> <eval token="hosts">replace($value$, " OR ", " OR host=")</eval> </change> </input> ... View more

Would this be the same for if I just had static options in my dropdown? ... View more

Hi Rich, I am using the lookup table to populate my dropdowns, but I do not want to create another dropdown for host. Is there a way to search for both hosts now that they are in separate rows? ... View more

After running that query, I get a table with 5 columns: application, environment, hostCode, sourceCode, and value (a combination of hostCode and sourceCode). At the bottom of all the events I am looking for, the last row contains host = .. source = .. sourcetype = .. The fields I am looking for in the panel are just host and source . Also, in my second dropdown, the token = host_src and the field for value = hostCode One more thing: Some of the values in my the hostCode column in my CSV contain 2 hosts - e.g. awslxappA-d* OR awslxappB-d* Thus, in the current search, which is host = awslxappA-d* OR awslxappB-d* , it only looks for events in the first value, so I would like it to be host = awslxappA-d* OR host = awslxappB-d* ... View more

So this is my search string for my panel: $host_src$ $srch$ When I open it in search after selecting a specific application and environment, I only get kwalxapptq010 * When the textbox is empty, like what it was for this example, $srch$ defaults to *. Thus, it seems like the sourceCode is left out of the query. The fields I am looking for are just host = .. source = .. and $srch$ The name of the field in my index that has values for sourceCode is source (based on the events retrieved from the query). ... View more

So this is my search string for the panel: $host_src$ $srch$ I am looking for host = .. source = .. $srch$ When I don't type anything into the textbox, it $srch$ defaults to an asterisk This is the query for when I select one specific application and its environment: kwalxapptq010 * For the sourceCode values, for most of them, they are just , but for a couple of them, like the one I tested for the search query above, they are *applicationName Thus, the query seems to be lacking the sourceCode ... View more

For the dropdown or the panel? I already did that for the dropdown ... View more

I did what you said, but it still isn't working properly. The dropdowns are now working again, which is an improvement, but host_src seems to only contain the host values. When I open the query in search, it only searches for the hosts and the text in the textbox, leaving out the source. In addition, I am looking for events with host = $host$ source = $src$ $srch$, not just $host$ $src$ $srch$. How can I do this? For reference, my csv file looks like this: application,environment,hostCode,sourceCode applicationA,DEV,awslxappA-d*,appA applicationA,PROD,awslxappA-p*,appA applicationA,QA,awslxappA-q*,appA applicationB,DEV,awslxappB-d*,appB applicationC1,DEV,awslxappC-d*,appC1 applicationC1,PROD,awslxappC-p*,appC1 applicationC1,QA,awslxappC-q*,appC1 applicationC2,DEV,awslxappC-d*,appC2 applicationC2,PROD,awslxappC-p*,appC2 applicationC2,QA,awslxappC-q*,appC1 ... View more

This is my dashboard XML: <input type="dropdown" token="app1" searchWhenChanged="true"> <label>Application</label> <search> <query>| inputlookup Lookup.csv | stats count by application| table application</query> </search> <fieldForLabel>application</fieldForLabel> <fieldForValue>application</fieldForValue> </input> <input type="dropdown" token="host_src" searchWhenChanged="true"> <label>Environment</label> <search> <query>| inputlookup Lookup.csv | search (application="$app1$" AND hostCode="$env$") | eval value="host=".hostCode." source=".src</query> <earliest>0</earliest> </search> <fieldForLabel>environment</fieldForLabel> <fieldForValue>hostCode</fieldForValue> </input> <input type="text" token="srch" searchWhenChanged="true"> <label>Search</label> <initialValue>*</initialValue> </input> <input type="time" token="time"> <label>Time</label> <default> <earliest>@d</earliest> <latest>now</latest> </default> </input> <panel> <event> <search> <query>$host_src$ $srch$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest> </search> Now the second dropdown doesn't even get populated, as it says "Could not create search" ... View more

In the second dropdown, it only shows one possible option with your example, leaving out the others which I used to be able to see. In the panel, it says "Search is waiting for input" even though I have selected everything ... View more

I tried what you suggested but came up with no events. To clarify, my lookup table contains four columns: application, environment, hostCode, and source in that order. My first dropdown, Application, with token 'app1', simply contains the names of the applications. The second dropdown, Environment, with token 'env', displays the possible environment names corresponding to that application, and based on your selection, a hostCode is assigned as the value for 'env'. After that, like you said, I have a textbox for keyword search, with token 'srch'. Therefore, in my current search query, all I have is host = $env$ $srch$ Now, I would like to have this as my search query: host = $env$ source = $src$ $srch$ What I do not understand what to do is how/where to extract the source from the lookup table and include it in the search query. ... View more

Hi sundareshr, I am not using another dropdown for source. This query retrieves the source value: | inputlookup lookup.csv | search (application="$app1$" AND hostCode="$env$") but I don't know how to "save" that value and search for it. Currently, I am trying to use the eval command to create a new variable. This is what I have: | inputlookup lookup.csv | eval src = search (application="$app1$" AND hostCode="$env$")| search host = $env$ source = $src$ $srch$ but it says that there is an error in the search command, and that Comparator '=' has an invalid term on the right hand side. ... View more

Hi sundareshr, This seems to be slightly different from what I am looking for. My dropdown does not create any events, as its only purpose would be to open a tab of the link to whatever is selected. ... View more

Hi sundareshr, I am not getting any events from that query ... View more

Thanks for the help! ... View more