I have a dashboard for showing the status of hosts.
I want the dashboard to populate when I choose the hosts via drop down/ radiobutton.
The two hosts groups are something like this.
My dashboard panels have a search like below:
index = abc hosts=ab* OR host =bc* source =svd.log....
Although I can create a dropdown for these host types I dont think i can replace the highlighted value in the query...
Can someone suggest me how to achieve this>?
Hi
Can you please try below XML?
<form>
<label>Multiple Value Dropdown</label>
<fieldset submitButton="false">
<input type="dropdown" token="Sourcetype">
<label>Source Type</label>
<choice value="scheduler,splunkd">A</choice>
<choice value="splunk_web_service,splunk_web_access">B</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$Sourcetype$</title>
<search>
<query>index=_internal [| makeresults | eval sourcetype="$Sourcetype$" | makemv delim="," sourcetype | mvexpand sourcetype | format] | stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Happy Splunking
Hi
Can you please try below XML?
<form>
<label>Multiple Value Dropdown</label>
<fieldset submitButton="false">
<input type="dropdown" token="Sourcetype">
<label>Source Type</label>
<choice value="scheduler,splunkd">A</choice>
<choice value="splunk_web_service,splunk_web_access">B</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>$Sourcetype$</title>
<search>
<query>index=_internal [| makeresults | eval sourcetype="$Sourcetype$" | makemv delim="," sourcetype | mvexpand sourcetype | format] | stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Happy Splunking
Thnakyou @ kamlesh_vaghela , that helped.