Best way to have a dashboard radio selector for specific hosts or a sourcetype which is then used in a panel's search?

[dougtoppin]

I have a few dashboards where I set up radio buttons that let the user select which host to search for. The panels each have a host=$selectedHost at the start to constrain the search. This works well except we also have a few sourcetypes set up where some groups of hosts have been created.

I need a way on a dashboard to let the user select a specific host or select a sourcetype, but I can't think of a way to have the search in a panel do one or the other. By that I mean "(if $selectedHost!=null then host=$selectedHost) else (sourcetype=$selectedSourcetype) the rest of the search".

I suspect that there is a better way to do this in general and am looking for any tidbits on how best to select either from a list of hosts or a list of sourcetypes to constrain a search.

[somesoni2]

How about this (run anywhere example)

<form>
  <label>Radio</label>
  <fieldset submitButton="false">
    <input type="radio" token="selectedFilter">
      <label>Filter Selector</label>
      <choice value="sourcetype=splunkd">sourcetype=splunkd</choice>
      <choice value="source=*license_usage.log">source=*license_usage.log</choice>
      <default>sourcetype=splunkd</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $selectedFilter$ | head 10</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="type">list</option>
        <option name="count">10</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>

[pradeepkumarg]

You can give two different drop downs and default them to *
if they select host, they will leave the sourcetype at * and if they select sourcetype they will leave host as *

host=host1 sourcetype=*

OR

host=* sourcetype=sourcetype1

Does this work for your case?

[dougtoppin]

The idea was helpful but I did it a little differently.

The host selector radio buttons had a field called hostVar and each one was set to a different hostname.

The change that I made was to add after each hostname value 'sourcetype=' so they look like this:
hostVar=host1 sourcetype=

I also added a new radio button for a sourcetype selection that has a value that looks like this:
sourcettype=mysourcetype hostVar=*

That panels already have this so the above works:
host=$hostVar$ my query

I'm not a pro at querying but the above seems to work.

tks for the suggestion