I'm trying to create dropdown menus, one for the Month and another for the Year, that use dynamic options and timepicker 'today' to default to Current Month and Current Year. I have tested that part successfully.
My question is I'm looking to fill the rest of my dropdown menus 'Month' and 'Year' with previous months and years so I can also search historical data. I have been testing using output lookup tables but I don't have a lot of experience using that option and hoping the community has a few possible options to try out.
Testing query :
index=*
| eval Time=strftime(_time, "%m/%d/%Y %I:%M:%S %p")
| rex field=Time "(?<date_month>\d+)/"
| rex field=Time "(?<date_year>\d{4})"
| dedup date_month
| dedup date_year
| table date_month, date_year
| output date_lookup
Try this!
| dedup date_month
| dedup date_year
↓
| dedup date_month,date_year
Try this!
| dedup date_month
| dedup date_year
↓
| dedup date_month,date_year
Thanks @HiroshiSatoh Have you worked with populating dropdown menus dynamically or with lookups before?
It is a sample dynamically setting a dropdown from the event log.
<input type="dropdown" token="yyyymm">
<label>Target Month</label>
<populatingSearch fieldForValue="trng" fieldForLabel="yyyymm">
<![CDATA[source="WinEventLog:System" (EventCode=6005 OR EventCode=6006) | table _time | eval yyyymm=strftime(_time,"%m/%Y")|dedup yyyymm| eval sdate=substr(yyyymm,1,2)+"/01/"+substr(yyyymm,4,4)+":0:0:0" | eval edate=strftime(relative_time(strptime(sdate,"%m/%d/%Y:%H:%M:%S"),"+1month"),"%m/%d/%Y:%H:%M:%S") | eval trng="earliest="+sdate+" latest="+edate]]>
</populatingSearch>
</input>