Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Changing Display columns depending on sourcetype

$
0
0
In Dashboard depending on sourcetype selected in the dropdown list, we want to display different fields on the dashboard. Since fields can change in the future we have created a lookup for it. So depending on source type the lookup should be queried and get the display columns. I am trying something like below but doesn't seem to work index=nirds sourcetype="XXX"|table [|inputlookup SourceType-Attributes sourcetype="XXX" | fields Attribute]

Viewing all articles
Browse latest Browse all 47296

Trending Articles