Falcon LogScale Documentation

The FreeText parameter type can be used when you want to filter or aggregate based on any kind of value. Other types of parameters give you options for what value might be worth selecting, but if no such values are available to make suggestions, then a free text parameter allows you to just type a value in.

The Query parameter type can be used when you want to filter or aggregate based on values that appear in your logs. When shown within the dashboard, the option values shown in the dropdown will be taken from the search results.

On top of the settings common to all parameter types, other specific settings needed for the Query parameter are:

Fill in the Query String field with a LogScale query. Usually you will want to use this in conjunction with an aggregate function like top() and find the most frequent values that appear in a certain field. For example, you could find all hosts in your production cluster using:

env=PROD | top(host)

You will need to then set host as the value in Dropdown Value Field, meaning it is the value of this field (host) in the search results from the query env=PROD | top(host) that should be bound to the parameters.

Using top() like in the example above is useful to get the most frequent values. If instead you want all possible values from the data, you can use the groupBy() function to get those values.

The most efficient way to do so is by calling groupBy() with no aggregation function, using:

groupBy(fieldName, function=[])

This will make groupBy() just gather the unique values without doing any operations on those values (like counting how many times they occur). If you just want all the unique values to populate our parameter, then you don’t need any additional work to be done.

regex(?regex, field="message")

The FixedList parameter is good when you have a small set of fixed values that will fit into a dropdown menu. If there are too many values to use this parameter type, however, the File parameter may be a better fit.

On top of the settings common to all parameter types, other specific settings needed for the Fixed List parameter are:

LogScale supports uploading of CSV and JSON files for use with the match() function in queries, but those same files can also be used for populating parameters.

On top of the settings common to all parameter types, other specific settings needed for the File parameter are:

Take this configuration as an example:

Figure 112. File Based Parameter Configuration

If example.csv has these contents:

userid,name,country
1,alice,us
2,bob,uk

Then using the parameter in the dashboard looks like this:

Figure 113. File Based Parameter Output

Selecting the alice option will insert the value 1 into the parameter, and the same for bob and 2.

We can also use the Value Filters configuration to hide entries from the output. Since example.csv also contains a country column, we can specify that we only want users from, for example, the USA

Figure 114. File Based Parameter with Static Filter

This would remove bob from the output, but we can also specify multiple values, separated by comma, or use a parameter as input. Using a parameter is the same as writing out the options yourself, but you type, for example, ?country instead of us, and you will get the appropriate options:

Figure 115. File Based Parameter with Dynamic Filter and Output