Dashboard Variable with Multiple Filters

cwinkler109 — Thu, 06 Jun 2024 18:55:52 GMT

I built a dashboard that surfaces website traffic patterns from info in our log events. Is it possible to configure a dashboard variable to filter the dashboard panels for either of these three categories of traffic: Real User traffic, Bot traffic, or Test Traffic?

Base DQL:

fetch logs | filter log.source=="my_source"

Here are the query filters for each of these traffic types:

Real User traffic: | filter not contains(content,"bot") and not contains(request,"-test")
Bot traffic: | filter contains(content,"bot")
Test traffic: | filter contains(request,"-test")

It's not clear to me how to approach this. Thanks for any advice.

Re: Dashboard Variable with Multiple Filters

krzysztof_hoja — Mon, 10 Jun 2024 18:19:53 GMT

Let's define filter this way:

and create DQL query so combines conditionally all filters:

fetch logs | filter ($Traffic=="Test" and contains(request,"-test") ) or ($Traffic=="Bot" and contains(content,"bot") ) or ($Traffic=="Real" and not contains(content,"bot") and not contains(request,"-test")) | fields content | limit 10

Depending on variable value only one condition will be active. Other 2 are are false, but they do not do any harm as are always false.

Kris

topic Re: Dashboard Variable with Multiple Filters in DQL

Dashboard Variable with Multiple Filters

Re: Dashboard Variable with Multiple Filters