You would do something like this
<form>
<label>New_dashboard</label>
<fieldset submitButton="false">
<input type="dropdown" token="clients">
<label>dropdown1(clients)</label>
<search>
<query>index=whatever host=client*|stats count by host</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<prefix>host="</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="servers">
<label>dropdown1(clients)</label>
<search>
<query>index=whatever host=server*|stats count by host</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<prefix>host="</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<!-- The Rest of your Dashboard goes here -->
</form>
This will produce two tokens, the value of which would be "host=clientxxx" or "host=serverxxx"
Hi
It could be usefull if you create before a lookup file to create the list and save theses searches to run every night.
index=xxx host=cliente* |table host |outputlookup clients.csv <- ALL TIME
index=xxx host=server* |table host | outputlookup servers.csv <- ALL TIME
You would do something like this
<form>
<label>New_dashboard</label>
<fieldset submitButton="false">
<input type="dropdown" token="clients">
<label>dropdown1(clients)</label>
<search>
<query>index=whatever host=client*|stats count by host</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<prefix>host="</prefix>
<suffix>"</suffix>
</input>
<input type="dropdown" token="servers">
<label>dropdown1(clients)</label>
<search>
<query>index=whatever host=server*|stats count by host</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
<prefix>host="</prefix>
<suffix>"</suffix>
</input>
</fieldset>
<!-- The Rest of your Dashboard goes here -->
</form>
This will produce two tokens, the value of which would be "host=clientxxx" or "host=serverxxx"
Thanks alot rsennett. This worked.