I have a form with a bunch of graphs, and the form text input is populated with the text "cross.promo.getlist" by default:
<fieldset> <input type="text" token="method"> <label>Method</label> <default>crosspromo.getlist</default> <seed>crosspromo.getlist</seed> </input> </fieldset>but i want to populate it with the top result from this query:
index="pbr" sourcetype="pbr_client" callMethod="" | stats count(eval(result="cancelled")) as cancelled count(eval(result="failure")) as failures count as total by callMethod | search cancelled > 5 | search failures > 5 | eval rateCancelled=cancelled100/total | eval rateFailure=failures*100/total | eval rateTotal=rateCancelled+rateFailure | sort rateTotal desc | fields - total cancelled failures rateTotal
This query gives me a ranking of callMethods (stream.getlist, crosspromo.get), and I'd like to populate the input text box with whatever I get as the top ranked callMethod instead of hardcoding the default value. Is this possible?
Thanks!
Joey Zynga Inc.