Hi,
I have two dropdown D1 and D2.
on selecting a value in D1 certain values from event gets filled in D2. Now if i change the value in D1 new values are getting filled in D2 along with the previous values.
How do I clear the D2 before filling new values?
I tried tag also but still not working
[[
]]
Hi there
Your approach is not too bad, but you have to take the token for the seachh. I assume that you set that in your first dropdown, since it's not visible here
An example, how i have to this multiple times. One with four dropdowns but showing only the first two.
<input type="dropdown" token="myindex" searchWhenChanged="true">
<label>Application Log</label>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| eventcount summarize=false index=log_*
| dedup index
| fields index</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<change>
<unset token="cust"></unset>
<unset token="mysourcetype"></unset>
<unset token="mysource"></unset>
<unset token="myhost"></unset>
<unset token="form.cust"></unset>
<unset token="form.mysource"></unset>
<unset token="form.mysourcetype"></unset>
<unset token="form.myhost"></unset>
</change>
</input>
<input type="dropdown" token="mysourcetype" searchWhenChanged="true">
<label>Sourcetype</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=$myindex$
| fields sourcetype
| dedup sourcetype
| table sourcetype</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<change>
<unset token="cust"></unset>
<unset token="mysource"></unset>
<unset token="myhost"></unset>
<unset token="form.cust"></unset>
<unset token="form.mysource"></unset>
<unset token="form.myhost"></unset>
</change>
</input>
Hi there
Your approach is not too bad, but you have to take the token for the seachh. I assume that you set that in your first dropdown, since it's not visible here
An example, how i have to this multiple times. One with four dropdowns but showing only the first two.
<input type="dropdown" token="myindex" searchWhenChanged="true">
<label>Application Log</label>
<fieldForLabel>index</fieldForLabel>
<fieldForValue>index</fieldForValue>
<search>
<query>| eventcount summarize=false index=log_*
| dedup index
| fields index</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<change>
<unset token="cust"></unset>
<unset token="mysourcetype"></unset>
<unset token="mysource"></unset>
<unset token="myhost"></unset>
<unset token="form.cust"></unset>
<unset token="form.mysource"></unset>
<unset token="form.mysourcetype"></unset>
<unset token="form.myhost"></unset>
</change>
</input>
<input type="dropdown" token="mysourcetype" searchWhenChanged="true">
<label>Sourcetype</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index=$myindex$
| fields sourcetype
| dedup sourcetype
| table sourcetype</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<change>
<unset token="cust"></unset>
<unset token="mysource"></unset>
<unset token="myhost"></unset>
<unset token="form.cust"></unset>
<unset token="form.mysource"></unset>
<unset token="form.myhost"></unset>
</change>
</input>
<label>Initiator</label>
<fieldForLabel>initiator_id</fieldForLabel>
<fieldForValue>initiator_id</fieldForValue>
<search>
<query>index="demo1" | dedup initiator_id | table initiator_id</query>
</search>
</input>
<input type="dropdown" token="targetsel" searchWhenChanged="true">
<label>Target</label>
<fieldForLabel>target_id</fieldForLabel>
<fieldForValue>target_id</fieldForValue>
<change>
<unset token="form.dropdown"></unset>
</change>
<search>
<query>index="demo1" initiator_id=$inits$ | dedup target_id | table target_id</query>
</search>
</input>