How do I Create a single dashboard panel with two different index and their respective source types displaying count for same field with a drop down suggesting for index selection i.e if i select a particular index from the dropdown respective count for that field is displayed and so on.
Hi
Check this and modify it accordingly
<form>
<label>filter</label>
<fieldset submitButton="false">
<input type="dropdown" token="selectedindex">
<label>Index Name</label>
<fieldForLabel>title</fieldForLabel>
<fieldForValue>title</fieldForValue>
<search>
<query>| rest /services/data/indexes | dedup title | table title</query>
</search>
<change>
<condition>
<unset token="form.sourcetype"></unset>
</condition>
</change>
</input>
<input type="dropdown" token="sourcetype">
<label>Source Type</label>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
<search>
<query>index="$selectedindex$" |stats count by sourcetype</query>
</search>
</input>
</fieldset>
<row depends="$sourcetype$">
<panel>
<table>
<search>
<query>index="$selectedindex$" sourcetype="$sourcetype$" |stats count by source</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Sharing the demo query details :
index=blc_db sourcetype=prd_spark_agg_blc_nginx_access OR
index=internal_smapi_db sourcetype=prd_spark_agg_smapi_be_events_per_request
|stats count by src
| bucket _time span=1d
Please help me in modifying the query