I have a dashboard. There are several inputs. One of them is a DateTime picker. I wish on the open as well as on choosing a new date range to fill a token value (that is a token from drilldown) with a set of values (for example - a comma separated) which I would like to retrieve from a separate query. I mean a query is not binded to any of the dashboards or the base query. This could be something like this: <form>
<fieldset submitButton="false">
<input type="time" token="dateFilter">
<label>By time</label>
<default>
<earliest>-7d@w0</earliest>
<latest>@w0</latest>
</default>
<change>
<set token="filial">
<query>
<search>
index=fed-trash source=spok
|stats values(FILIAL_ID)
|eval f = mvjoin(FILIAL_ID, ",")
</search>
</query>
</set>
</change>
</input>
</fieldset> This is wrong ofcourse, but I hope this explains what I want. Actually I want the produced result from a query above: FILIAL_ID 1111 2222 3333 would be transformed to a string 1111,2222,3333 and be paste as if I set a token by this: <change>
<set token="filial">1111,2222,3333</set>
</change> as I use token $filial$ further in my dashboad query at WHERE-clause like this index=... source=...
|where FILIAL_ID IN ($filial$)
...
... View more