0

I was wondering if it was possible if you could change the value of a token (dropdown menu) in a query.

For context: I have a dropdown menu - which has values 1,2,3. I am using these values in a search query. However, I am also using another search query with a different index on the same dashboard that uses a,b,c. Is there a way to map the values 1,2,3 -> a,b,c or do it within the search query using an eval or something?

Thanks

DoubleRainbowZ
  • 132
  • 1
  • 9

2 Answers2

1

You can set multiple tokens when you select an item from a dropdown. Here is one way of doing it, I'm sure there are others. You would use token1 in your first search, and token2 in the second.

<input type="dropdown" token="token1">
  <label>Select an option</label>
  <default>1</default>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <choice value="3">3</choice>
  <change>
    <condition label="1">
      <set token="token2">a</set>
    </condition>
    <condition label="2">
      <set token="token2">b</set>
    </condition>
    <condition label="3">
      <set token="token2">c</set>
    </condition>
  </change>
</input>
Simon Duff
  • 2,631
  • 2
  • 7
  • 15
0

If I understand you correctly, you're wanting to use the same base search to populate several dropdowns - is this correct?

What I do on dashboards when I want to do something like this is in the XML, put a search like the following:

<search id="dropdownbase">
    <query>index=ndx sourcetype=srctp fieldA=something fieldB=somethingelse earliest=-24h latest=now
    | stats count by fieldA fieldB
</search>

Then, in the search for the dropdown (ie the dynamic portion), add/modify the following:

<search base="dropdownbase"></search>

And then set your field for value vs field for label to fieldA or fieldB as appropriate

warren
  • 32,620
  • 21
  • 85
  • 124
  • Sorry if I was unclear. What I meant was use the same dropdown to populate multiple base searches, but within those different searches use different mappings of values. So if I have a dropdown of values 1,2,3 I use them in a search lets say: message=$token$, but then in another search I actually want to search a,b,c rather than 1,2,3, I was wondering if its possible to use the same dropdown, but map the values of 1,2,3 -> a,b,c for that search – DoubleRainbowZ Apr 29 '20 at 22:03
  • 1
    @DoubleRainbowZ - Simon's answer will work: if the dropdown entries are static. If they're generated by a search, it will not. – warren Apr 30 '20 at 12:44
  • 1
    @DoubleRainbowZ: if you have a dynamically-populated dropdown, you can't do what you're describing. *TYPICALLY*, you'd see one or more base searches populating dropdowns, if they're related, and then getting several different tokens populated out for other searches – warren Apr 30 '20 at 12:45