Hello everyone,
I am trying to assign a value to "myVar", which depends on a dropdown token on my dashboard. The value of "myVar" is used to search for a specific sourcetype. This is my current solution which does not work:
index="dev_analytics" OR index="live_analytics" |
eval myVar=case($instance$==servertoserver-test,"flink_dev2",$instance$==servertoserver-prod,"s2sdatacollector") |
where sourcetype==myVar
It works, if I just assign the specific value to "myVar" (eval myVar=="mySourcetype"). For specifc reasons, I can not do something like sourcetype=$instance$.
Is there anything I can do to make my solution work?
Thanks in advance and regards,
Eric
↧