How to apply values in dropdown to the search?

[Julia1231]

Hi,

I want to create a line chart that contains value come from an index to see the data trend.
Something like this:

|timechart span=10min avg(value) by id

   Knowing that I have:

   - An index, I have id and their events (values corresponding)

   - A lookup csv which contains the id, address.

I want to do a filter the search by province (group by address). Knowing that a province will have several id.

So, I create a dropdown in which I find all the province  --> done

---> Next,  I have to use the dropdown token to apply to the search but I have no info of the province in the index.

And the id are displayed as below, which prevent me from using append the province to each id:

_time

id1

id2

id3

Thanks for your help!

[Julia1231]

I have tried to use 

|lookup lookup.csv id OUTPUT address

then group the address with the same logic in the dropdown.

After that I compare the selected value in dropdown and the province in the search.

But it remains a problem that when I choose All from dropdown (contains all addresses), it returns nothing but I want to have data from all address in fact

[Manasa_401]

Hi @Julia1231 

What is the value you set for All in the dropdown?

To get all data set the value as "*"

<choice value="*">All</choice>

Thanks,

Manasa

[gcusello]

Hi @Julia1231,

if the IP that you have in the lookup are public IPs, you can map them using the iplocation command and in this way extract the region, the country and the city,

I don't know what you mean with province but maybe you can group more cities in provinces.

Ciao.

Giuseppe

[Julia1231]

Hi @gcusello ,

I group the adress by the common pattern in the name, not the real IP that I can use to find the region, etc. I just took an example as province.