I'm looking for a way to display a table based on a dropdown input in a dashboard. For example, if I choose "ASA" as the sourcetype, I want the table to only display the fields _time, host, src dest but if I choose "Infoblox" then I want the table to display _time, dhcpresponse, dnsquery, etc. Is there a way to do this in simple XML?
Do it like this:
<fieldset>
<input type="dropdown" token="fields_by_sourcetype_token">
<label>Fields by Sourcetype</label>
<choice value="_time host src dest ">ASA</choice>
<choice value="_time dhcpresponse dnsquery">Infoblox</choice>
<default>ASA</default>
</input>
Then do this:
<searchString>Blah BLAH BlAh | table $fields_by_sourcetype_token$</searchString>
Do it like this:
<fieldset>
<input type="dropdown" token="fields_by_sourcetype_token">
<label>Fields by Sourcetype</label>
<choice value="_time host src dest ">ASA</choice>
<choice value="_time dhcpresponse dnsquery">Infoblox</choice>
<default>ASA</default>
</input>
Then do this:
<searchString>Blah BLAH BlAh | table $fields_by_sourcetype_token$</searchString>
You rock!