host is same across all the env. i am facing issue when i bind the same value to drop down list saying "Duplicate values causing conflict". But i need dropdown list with TEST/QA/PROD(label) with same host value. - how can i achieve this? ... View more

i have replaced with like.. but it search from one host only. as i mentioned in QA i have 3 hosts and Prod i have 3 hosts. i have used dedup label to avoid duplicate in drop down list . but search result containes only from one host. not from all the 3 hosts if i select QA or PROD. please advise.   <input type="dropdown" token="envtoken"> <label>env</label> <fieldForLabel>label</fieldForLabel> <fieldForValue>host</fieldForValue> <prefix>(host=</prefix> <suffix>)</suffix> <search> <query> index=aaa (source="/var/log/testd.log") |stats count by host | eval label=case(like(host, "%tv00.test"), "Test", like(host, "%qv00.qa"), "QA", like(host, "%pv00.prod"), "Prod")| dedup label</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input>   ... View more

so we cannot load index dynamically from log files, correct? ... View more

i tried below: but it didnt return anything (source="/var/ltest/test.log") |table index     ... View more

in QA and PROd i have 3 servers test - testhost qa - qahost1,qahost2,qahost3 prod - prodhost1,prodhost2,prodhost3 and my query would be for qa if i choose qa from dropdownlist   index=aaa(source="/var/log/tes1.log" (host=qahost1) OR (host=qahost2,) OR (host=qahost3) )   can you please help me integrate above one with below query? index=aaa source="/var/log/test1.log" |stats count by host | eval category=case(match(host, "t"), "Test", match(host, "q"), "QA", match(host, "p"), "Prod", true(), "Unknown") ... View more

i want to filter based on Timeframe. so i cant remove that ... View more

So we have to create two different drop down list for each path and show/hide can be used? ... View more

i want to add  in source index=test (source="/test/log/path/qaserver1.log") without showing these path in dropdown list to user.. can we have some other method?. ... View more

eg. i have in drop down i have server and cloud.  if i select Server - the path would be  source="/test/log/path/server1.log"   if i select cloud the path would be vary for each region. for TEST -  source="/test/log/path/testserver1.log" for QA -   source="/test/log/path/qaserver1.log" for PROD -   source="/test/log/path/prodserver1.log"   so i kept the first drop down list to select server and cloud. And then environment drop down lsit. and remaining panels load based on the server/cloud drop down list and env .drop down list ... View more

can u pls.s give some sample. my requiremnt is i do have two differnt paths index=test (source="/test/log/path/test1.log" ) index=test (source="/test/log/path/test2.log" ) based on dropdownlist value the above the path should be taken in Search string ... View more

Please ignore the above query. It works perfect ... View more

i am getting as below: Dept Success  Failure total Accounts 5 0 5 Accounts 0 1 1 Mechanical 0 6 6 Mechanical 2 0 2   i want as  Dept Success  Failure total Accounts 5 1 6 Mechanical 6 2 8 ... View more

2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Accounts\", \"Time1\": \"3.04\"}" 2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Mechanical\", \"Time2\": \"4.05\"}" 2023-07-13 07:53:15,155 - __main__ - INFO - "{\"Id\": \"123456JKL\", \"Dept\": \"Mechanical\",\"Error\": \"ErrorFound\"}" Here i am  extracting each field and showing in table. if error found, adding Status as Success and Failure as below | stats values(*) as * by UniqueId| eval Status=if(match(Error,"^[a-zA-Z0-9_]"),"Failure","Success")| stats Count by PhaseName,Status with the above code  Dept Status Count Accounts Success 4 Accounts Failure 7 Mechanical Success 4 Mechanical Failure 4   But i want like this: Dept Success  Failure total Accounts 5 1 6 Mechanical 6 2 8 ... View more