Calling an input value from a widget

Introduction

Both types of inputs can be used as variable elements for widgets. The widget's query must reference the required input through a script placed in the part of the query you want to substitute with the input values. This script consists of the input ID and the value suffix joined by a dot (InputID.value) and can be accompanied by an operator depending on the function the input values fulfil inside the query.

All widget and input ID values are assigned automatically and can be read in the Data settings of the widget or input element.

Depending on the data to be entered in the input and their function inside the widget query, you can use the following types of expressions and operators:

`query(InputID.value)`

query(InputID.value)

Use this expression in the widget query as a placeholder for whole queries.

Example

query(Input0.value)

Enter the required query in the input and the widget will display the query results. In the example on the left, a valid option would be:

Input0 → from demo.ecommerce data where method = GET

$InputID.value

Use the $ operator in the widget query to indicate that the text specified in the input has a specific format and matches that of the parameter to be replaced. This is used as a placeholder for specific values, which is mostly required in the case of filter operations.

Example

query(from demo.ecommerce.data
where method=$Input0.value)

Enter the required filtering options in the input and the widget will display the result of the filter operation. In the example on the left, some valid options would be:

Input0 → GET, POST, PUT

$*InputID.value

Use the $* operator in the widget query to indicate that the text specified in the input has no specific format and is just a string of characters to replace query options or fields instead of specific values. This is used as a placeholder for whole query parts or fields.

Example

query(from $*Select0.value
group every $*Select1.value
by $*Select2.value)

Enter the required query part or field in the input and the widget will display the results. In the example on the left, some valid options would be:

Select0 → demo.ecommerce.data, siem.logtrust.web.activity
Select1 → 10m, 20m,30m
Select2 → method, locale, username

These expressions will make your widgets show data according to the content introduced in the inputs referenced in their queries, however, they will not show anything until the input contains valid values. If you want them to show content prior to manual selection, you can further configure them as explained in the following article: Show data in widgets before entering values in inputs

Examples

You can use multiple inputs simultaneously to generate a widget able to display different sets of data with just a few clicks. Below are some examples that may help you better understand the potential of inputs.

Use the following query in a table widget to create a dynamic table that allows you to specify the source data table, the grouping period, and the grouping key.

The table is linked to three different Select-type inputs populated with the values shown below.

Select0

["demo.ecommerce.data", "web.all.access"]

Select1

["2m", "5m", "10m", "1s"]

Select2

["statusCode", "method"]

The following capture shows the table after selecting demo.ecommerce.data as source table, 1s as grouping time and statusCode as key column for the grouping.

Use the following query to feed a column widget to display the count of status codes greater than a specified value and grouped by a period selected from a list of values.

The Select-type input is populated with the values shown below.

Select0

["5m", "10m", "15m"]

Input0

Free text

The following capture shows the column widget after entering 5m in the free-text input as grouping period and selecting 400 in the select input as filtering value, so that only status codes greater than 400 are shown in each five-minute period. You must select the count field as the Y-axis value and add the statusCode column as a series in the Visual settings of the column widget.