Create a variable on Dashboard from log metric data

[andre_vdveen]

I have created a log metric for IIS logs, which provides the http.target (URI) as a dimension and I want to use that as a variable so that users can select from (split by) the different URIs to see the URL queries relating to these URIs.

I'm struggling with the DQL for the variable though, as I end up with non-URI related options in my results - any suggestions what the DQL would look like to split / filter by URI for a metric log.examplemetricname?

[marco_irmer · Accepted solution]

The simplest way to accomplish this will be to utilize the fields command to take the timeseries data down to just the field(s) of interest. 

DQL:

timeseries sum(log.examplemetricname), by:{http.target}
| fields http.target

[andre_vdveen]

Thank you @marco_irmer, this seems so easy and simple now that I know the solution, hahaha! 
I clearly try to overcomplicate DQL 😉