hi.
i have an drop-down field named status with open, closed and inprogess values. like this:
select status
open
closed
inprogess
i want to pass a value of status drop-down input to an eval command in my dashboard search when i click on status value like this:
...|eval status=$status$
how can i do it ??
thank.
hi
try this
...|eval status="$status$"
thank Mr gyslainlastsa
You need to set your dropdown to supply the selection into your status
-token, for example by setting the "Token" field while editing the dashboard in the web UI or setting token="status"
in the input
tag in XML.
Here's an example of working XML code:
...
<panel>
<input type="dropdown" token="lang" searchWhenChanged="true">
<search>
<query>index=twitter | top limit=20 lang</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>lang</fieldForLabel>
<fieldForValue>lang</fieldForValue>
<delimiter> OR </delimiter>
</input>
<chart>
<search>
<query>index=twitter lang=$lang$ | ...</query>
<earliest>-1d@d</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">bar</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">default</option>
...
It should work; did you adjust the searches according to your data?
If you don't want your dropdown to be populated with the possible statuses, you can also supply it with a static selection:
<input type="dropdown" token="status">
<label>Statuses</label>
<choice value="open">open</choice>
<choice value="closed">closed</choice>
<choice value="inprogress">inprogess</choice>
</input>
i already created dropdown status.
but i want to take a value of status like
|eval status=$status$
but don't work.
jeffland thank for you answer but it not correct.
please splunkers i need help.
thank.