I have two inputs on my dashboard, the first is a dropdown input and the second is a multiselect. The first dropdown shows a list of asset types (host, vm, pc, etc.) and the second multiselect input is a list of operating systems. When somebody clicks on on an asset type, I'd like the multiselect to populate with only operating systems for that device type.
<form>
<label>CMS_OS_TEST2</label>
<fieldset submitButton="false">
<input type="dropdown" token="sourcetype" searchWhenChanged="true">
<label>Asset Type</label>
<choice value="*">ALL</choice>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>(index=cms_vm OR index=cms_host OR index=cms_pc)
| eval sourcetype=case(sourcetype == "cms_vm", "VM", sourcetype == "cms_host", "Host", sourcetype == "cms_pc", "PC")
| table sourcetype
| dedup sourcetype</query>
<earliest>0</earliest>
<latest></latest>
</search>
</input>
<input type="multiselect" token="osfield" searchWhenChanged="true">
<label>Operating System</label>
<fieldForLabel>OperatingSystem_Code</fieldForLabel>
<fieldForValue>OperatingSystem_Code</fieldForValue>
<search>
<query>(index="cms_pc" OR index="cms_vm" OR index="cms_host"
| eval sourcetype=case(sourcetype == "cms_vm", "VM", sourcetype == "cms_host", "Host", sourcetype == "cms_pc", "PC")
| eval OperatingSystem_Code=case(sourcetype == "cms_pc", OperatingSystem_Code, sourcetype == "cms_vm", OperatingSystem_Code, sourcetype == "cms_host", OperatingSystem_Code)
| dedup OperatingSystem_Code</query>
<earliest>0</earliest>
<latest></latest>
</search>
<choice value="*">ALL</choice>
<valuePrefix>OperatingSystem_Code="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter> OR </delimiter>
</input>
</fieldset>
</form>
To sum it up: when I select 'PC' for the asset type, I only want to see Operating Systems found in the PC index, so on and so forth.
You can add sourcetype=$sourcetype$
in the query for your multiselect search, which will use the first token to search for the second.
You can add sourcetype=$sourcetype$
in the query for your multiselect search, which will use the first token to search for the second.
Thanks for your help. Working well now.