Hi,
I am creating a dashboard with 2 drop-downs, one for Services
and the other for Methods
, and I want the search to look for all events with the selected Service
and Method
.
However, the values in the drop-downs do not perfectly match what I am looking for. For example, one of the services in the drop-down may show - Enrollment Web Service (NRLMT_WS)
and the method may be - Get Enrollments (GET_NRLMT)
, but in my search , I want to look for all events where Service = NRLMT_WS AND Method = GET_NRLMT
.
Considering that all the options in the drop-downs are in this format: their description and then its key phrase in parentheses, what is the search for this?
Thanks
The description of your dropdown can be different from the string value of that goes into the associated token. So have the description be Enrollment Web Service (NRLMT_WS)
, the token value be NRLMT_WS
. Then have your search be like this:
... Service="$Service_Token$" Method="$Method_Token$"
The description of your dropdown can be different from the string value of that goes into the associated token. So have the description be Enrollment Web Service (NRLMT_WS)
, the token value be NRLMT_WS
. Then have your search be like this:
... Service="$Service_Token$" Method="$Method_Token$"
Try this for your service and method dropdown (rest all same)
<input type="dropdown" token="service1" searchWhenChanged="true">
<label>Service</label>
<search>
<query>| inputlookup Lookup.csv | search source="$source1$" | stats count by service | table service | rex field=service "\((?<service_value>[^\)]+)\)" </query>
</search>
<fieldForLabel>service</fieldForLabel>
<fieldForValue>service_value</fieldForValue>
</input>
<input type="dropdown" token="method1" searchWhenChanged="true">
<label>Method/Operation</label>
<search>
<query>| inputlookup Lookup.csv | search (source = "$source1$" AND service = "*($service1$)")| stats count by method | table method | rex field=method "\((?<method_value>[^\)]+)\)" </query>
<earliest>0</earliest>
</search>
<fieldForLabel>method</fieldForLabel>
<fieldForValue>method_value</fieldForValue>
</input>
Do you've static values in the dropdowns OR it's being populated using a query? In both cases you can have "value" portion to use the value inside parenthesis.
Other option would be to update your panel search to do the regex/transformation of the selected value. Could you post your dashboard xml, with searches being used?
Hi somesoni2,
Here is my current dashboard XML:
External Interfaces
<input type="dropdown" token="source1" searchWhenChanged="true">
<label>Source</label>
<search>
<query>| inputlookup Lookup.csv | stats count by source | table source</query>
</search>
<fieldForLabel>source</fieldForLabel>
<fieldForValue>source</fieldForValue>
</input>
<input type="dropdown" token="service1" searchWhenChanged="true">
<label>Service</label>
<search>
<query>| inputlookup Lookup.csv | search source="$source1$" | stats count by service | table service</query>
</search>
<fieldForLabel>service</fieldForLabel>
<fieldForValue>service</fieldForValue>
</input>
<input type="dropdown" token="method1" searchWhenChanged="true">
<label>Method/Operation</label>
<search>
<query>| inputlookup Lookup.csv | search (source = "$source1$" AND service = "$service1$")| stats count by method | table method</query>
<earliest>0</earliest>
</search>
<fieldForLabel>method</fieldForLabel>
<fieldForValue>method</fieldForValue>
</input>
<input type="time" token="time" searchWhenChanged="true">
<label>Last Transaction Time</label>
<default>
<earliest>@d</earliest>
<latest>now</latest>
</default>
</input>
<panel>
<event>
<title>Most Recent Event</title>
<search>
<query>Service = $service1$ Method = $method1$|sort -_time | head 1</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
<option name="count">10</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>