I have a received a request to add the ability for users to filter out very specific events from a dashboard with a large amount of data on it. The method of identifying and removing these events are not consistent. Some of the filters will be filtering on host, others by text in the message body, others by extracted fields.
I would like for the default behavior (NULL) of this input to display all, and each check box or multi-select item that is activated would then filter out the related items. I have considered setting a default value that acted like a form of a wildcard (like a "Show All"), but I'm unable to determine a method of this working effectively.
I might be missing something obvious, but I need to find a method of running a dashboard that has input panels that can be ignored when no value is selected.
Essentially, if this is my search string in a panel:
index=* host=1.1.1.1 $Severity$ $Filter$
If the value of Input1 is set to "Critical" and Input2 is left unselected , the effective search string would be "index=* host=1.1.1.1 foo" in not "Search is waiting for input"
↧