Hi all,
I wanted to know if someone can help me figure out how to write my token for the following drop-down list search I trying to do on my dashboard. Please see below my XML code below. I am able to list the names within the field I am trying to get but it does not update the results. Thank you
<form>
<label>Camilla</label>
<fieldset submitButton="false">
<input type="dropdown" token=""$CardholderName$="" searchWhenChanged="true">
<label>Select a User:</label>
<search>
<query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description |
dedup CardholderName | sort CardholderName</query>
</search>
<fieldForLabel>CardholderName</fieldForLabel>
<fieldForValue>CardholderName</fieldForValue>
<prefix>"$CardholderName$=</prefix>
<suffix>"</suffix>
<choice value="*">All</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description</query>
<earliest></earliest>
<latest></latest>
</search>
</table>
</panel>
</row>
</form>
Here is a simple example that shows you how it's done in general, adjust to your specific needs.
<form>
<label>Token Test</label>
<fieldset submitButton="false">
<input type="dropdown" token="mySourcetype" searchWhenChanged="true">
<label>Select a Sourcetype:</label>
<search>
<query>index=_internal earliest=-30m |stats values(sourcetype) as st | mvexpand st</query>
</search>
<fieldForLabel>st</fieldForLabel>
<fieldForValue>st</fieldForValue>
<choice value="*">All</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>Count for sourcetype: $mySourcetype$</title>
<table>
<search>
<query>index=_internal earliest=-30m sourcetype=$mySourcetype$</query>
<earliest></earliest>
<latest></latest>
</search>
</table>
</panel>
</row>
</form>
Thank you, I see now that it filters on the person I want to see. However, when the search is set to all, the column is eliminated so I can't see all of the user names. If I choose a name on my drop down list, it then puts the column back on the report as CarholderName=Barbosa,Isaac but it does not list my name next to the records.
Camilla
<input type="dropdown" token="CardholderName" searchWhenChanged="true">
<label>Select a User:</label>
<search>
<query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, CardholderName, Access_Point_Description | dedup CardholderName | sort CardholderName</query>
</search>
<fieldForLabel>CardholderName</fieldForLabel>
<fieldForValue>CardholderName</fieldForValue>
<choice value="*">All</choice>
<default>*</default>
<prefix>"CardholderName=</prefix>
<suffix>"</suffix>
</input>
<panel>
<table>
<search>
<query>sourcetype="Camilla - All Events" Title="LOCAL ACCESS REPORT"| table Title, Event, Date_Event, Access, Access_Point, Security_Area, $CardholderName$, Access_Point_Description</query>
<earliest></earliest>
<latest></latest>
</search>
</table>
</panel>