I have a dashboard with thre saved searches for three server environments. The searches only differ based on which environment the search matches. What I want to do is make it so that a dropdown can be used to set a search term to specify the environment to search against rather than having a separate saved search for each environment. The environment an entry came from is determined by a substring of the host name that exists for test or beta environments but not production.
For example I would want to set the following search terms based on the selected value
Test is selected: "host=*Test*"
Beta is selected: "host=*Beta*"
Test is selected: "NOT host=*Test* NOT host=*Beta*"
I can probably do the matching more efficiently, but that's another mater.
Here is what my current saved search looks like for the test environment:
source="C:\\Logs\\*.log"
host=*Test*
level=Error
|cluster showcount=t field=ExceptionStackTrace t=0.9
| sort - cluster_count
| table ExceptionType ExceptionMessage ExceptionStackTrace cluster_count
How can I make my search reference the selected dropdown value?
I created dropdown with the following XML:
<input type="dropdown" token="_environmentSelected" searchWhenChanged="true">
<label>Environment</label>
<choice value="host=*UTT*">Test</choice>
<choice value="host=*UTS*">Stage</choice>
<choice value="NOT host=*UT*">Production</choice>
</input>
How do I reference the selected dropdown value in the search?
... View more