Do dashboard filters/variables exist?

[samf (Sam)]

Hi folks,

Forgive me if I’ve missed docs, I believe this just isn’t supported but would like to be sure.

I am trying to create dashboards that will be used across multiple clients (all logs aggregate to our server) but can’t see a way to filter a dashboard.

I was hoping for something like Grafana where you can add a dropdown (or just a free entry textbox) where you select a specific value, ie “Client1” and it filters the data.

I would also be happy with just being able to add something to the query being used in the individual widget/panels.

Ie I would add enter “AND client = 1” into a field and this would be appended to the query on all the widgets.

This seems a pretty basic thing to me to help you drill down on issues etc but is this just not a use case other people have?

Thanks!

[tmacgbay]

You may be looking for something like Search Parameters? It requires an Enterprise License but as long as you keep your logs < 2GB you can have one for free…

[gsmith]

Hello @samf

Just chiming in on this statement.

@samf

Ie I would add enter “AND client = 1” into a field and this would be appended to the query on all the widgets.

Depending on how the Widget is configure, Here are some examples in my lab querying by “source”.

Example:
Dashboard “Central Command Unit Section” with Aggregating count by source.

Let’s say I want to add a quick filter on device called veam. Click the down arrow next to the name and select " add to query"

Next example:

Dashboard “Central Command Unit Section” with Aggregating count by source called “veam”

and I want to add a different device call keycloak.

Next example :
Widget made for trending data on veeam device only, so I configured this widget like so…

Dashboard looks like this…

adding new device Keycloak to widget.

Only other way I know how to add info is what @tmacgbay suggested above.

[samf (Sam)]

Thanks this is the behaviour I’ve already seen, unfortunately we are bringing in a lot of logs from disparate sources and in different formats so I’m not sure this is appropriate! I think the enterprise Search Parameter feature is probably what we need.

I really appreciate the suggestion though!

[samf (Sam)]

That is 100% what I’m looking for, thank you!

I’m hesitant to tie into something that requires staying too low though, we are (slowly but surely) building this out as a scalable solution to address a lot of clients. <2GB might be practical now but it hopefully won’t be long term. I’ll drop sales a line when I have time and see whether the lowest tier might be manageable.

Thanks for your help and suggestion!