I have a few dashboards where I set up radio buttons that let the user select which host to search for. The panels each have a host=$selectedHost
at the start to constrain the search. This works well except we also have a few sourcetypes set up where some groups of hosts have been created.
I need a way on a dashboard to let the user select a specific host or select a sourcetype, but I can't think of a way to have the search in a panel do one or the other. By that I mean "(if $selectedHost!=null then host=$selectedHost) else (sourcetype=$selectedSourcetype) the rest of the search".
I suspect that there is a better way to do this in general and am looking for any tidbits on how best to select either from a list of hosts or a list of sourcetypes to constrain a search.
How about this (run anywhere example)
<form>
<label>Radio</label>
<fieldset submitButton="false">
<input type="radio" token="selectedFilter">
<label>Filter Selector</label>
<choice value="sourcetype=splunkd">sourcetype=splunkd</choice>
<choice value="source=*license_usage.log">source=*license_usage.log</choice>
<default>sourcetype=splunkd</default>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>index=_internal $selectedFilter$ | head 10</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
<option name="type">list</option>
<option name="count">10</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>
</row>
</form>
You can give two different drop downs and default them to *
if they select host, they will leave the sourcetype at *
and if they select sourcetype they will leave host as *
host=host1 sourcetype=*
OR
host=* sourcetype=sourcetype1
Does this work for your case?
The idea was helpful but I did it a little differently.
The host selector radio buttons had a field called hostVar and each one was set to a different hostname.
The change that I made was to add after each hostname value 'sourcetype=' so they look like this:
hostVar=host1 sourcetype=
I also added a new radio button for a sourcetype selection that has a value that looks like this:
sourcettype=mysourcetype hostVar=*
That panels already have this so the above works:
host=$hostVar$ my query
I'm not a pro at querying but the above seems to work.
tks for the suggestion