0

I have 20 indexes where we want to display them in drop down in grouping manner ..how can we group them in a query ? for example:-

index1,Index2,index3 should come with name abc.... Index 4, index 2, index 5 should come with name efg...

so in drop down we should see only value as abc , efg. so once will select abc the below pannel should show graph accordingly..

  • It's unclear what you're trying to accomplish - are you wanting to have a dropdown populate a token that would contain text like `(index=ndx1 OR index=ndx2 OR index=ndx3)`? – warren May 13 '20 at 14:44
  • no here index name only contains the value like index name pink .. like that only we have 20 index , and just i want to take index name .. so in dropdown i need only say colour where it contains 3 index name (ndx1=white ndx2=blue ndx3=green) and in same drop down i need other option say paint where it containd (ndx8=grey ndx9=Yello ndx11=black) – Supriya Sharma May 13 '20 at 20:05
  • that's what I was wanting to know, but it appears @SimonDuff beat me to the example :) – warren May 14 '20 at 15:13

1 Answers1

0

Putting the following at the start of your form/dashboard will give you a dropdown list, from which you have options abc and def, corresponding to the set of indexes you mentioned.

<form>
  <label>Index Group Test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="indexes">
      <label>Index Group</label>
      <choice value="index=index1 OR index=index2 OR index=index3">abc</choice>
      <choice value="index=index4 OR index=index5 OR index=index6">def</choice>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
</form>

You would then use the token $indexes$ in your query to get the selected index data. For example,

<form>
  <label>Index Group Test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="indexes">
      <label>Index Group</label>
      <choice value="index=index1 OR index=index2 OR index=index3">abc</choice>
      <choice value="index=index4 OR index=index5 OR index=index6">def</choice>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>Event Data</title>
        <search>
          <query>$indexes$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</form>
Simon Duff
  • 2,631
  • 2
  • 7
  • 15