Hello,
I have a number of unique searches for various infrastructure resources. I would like to create a dashboard that builds a chart based on the chosen entry from a dropown. Unfortunately, there's no easy way to create a base search and use tokens.
In other words, I would like each input title to reference a specific search in datsources.
example dropdown:
input selected value 1= "dataSources": "search_1"
input selected value 2 = "dataSources": "search_2"
input selected value 3 = "dataSources": "search_3"
I could not find any documentation with examples of something similar.
Thanks in advance.
I solved the challenge on my own.
I created multiple input items and used the search as the value. Then, I used the token from the input as the primary datasource.
Example
"input_1": {
"options": {
"items": [
{
"label": "Metric 1",
"value": "| mstats ***unique-search-string1******"
},
{
"label": "Metric 2",
"value": "| mstats ***unique-search-string2******"
},
{
"label": "Metric 3",
"value": "| mstats ***unique-search-string3******"
}
],
"defaultValue": "",
"token": "hosts_tok"
},
"dataSources": {
"primary": "$hosts_tok$"
},
"title": "Hosts",
"type": "input.dropdown"
}
If there's a better way please let me know.
I solved the challenge on my own.
I created multiple input items and used the search as the value. Then, I used the token from the input as the primary datasource.
Example
"input_1": {
"options": {
"items": [
{
"label": "Metric 1",
"value": "| mstats ***unique-search-string1******"
},
{
"label": "Metric 2",
"value": "| mstats ***unique-search-string2******"
},
{
"label": "Metric 3",
"value": "| mstats ***unique-search-string3******"
}
],
"defaultValue": "",
"token": "hosts_tok"
},
"dataSources": {
"primary": "$hosts_tok$"
},
"title": "Hosts",
"type": "input.dropdown"
}
If there's a better way please let me know.
Amazing!, thanks brother @squared_away , got your idea, i'm prefer using saved search because applicable for form.token , instead of put SPL query under value because required add backslash \
it's very simple we just create simple form
{
"type": "input.dropdown",
"title": "Testing Multi Query",
"options": {
"items": [
{
"label": "Query 1",
"value": "| makeresults | eval key=\"value\" | table *"
},
{
"label": "Query 2",
"value": "| loadjob savedsearch=\"admin:itsi:sla_availability\" artifact_offset=0"
},
{
"label": "Query 3",
"value": "| savedsearch \"AWS - IPs available\""
}
],
"token": "tos",
"defaultValue": ""
}
}
And create the visualization with my example token $tos$ bellow :
@squared_away - Kindly approve your own answer by clicking on the "Accept as Solution" button.