You might have a dashboard which has multiple widgets and require the same input from a filter, for example, Log Field. Then, the value you select in the Log Field filter will be applied on all the linked widgets.

This would be useful when you want to analyze the output of the widgets based on a filter input.

Let us consider the scenario where we have two widgets db_demo and sqldb_demo which require input log source value Linux Syslog Logs from the filter Log Field. Then, to create a filter that can be used by both the widgets,

1. Go to the Dashboards listing page, and click the one which must be edited. The Dashboard Details page opens. Click Actions, and click Edit.

2. Drag and drop the widgets from the Widgets pane and Add widgets tab.

3. Click the Filters pane, and click Add Filters. Create a log field filter with Log Source field name. See Filter Example: Log Field.

   Go to Edit Filters tab and modify the label of the log field filter, if required.

4. Go the Widgets pane, and click Edit Widgets. Here, you will see both the widgets that you had added earlier, for example, db_demo and sqldb_demo.

   Expand each widget to edit it. Click Add Input. The Configure Input dialog box opens.

   Select the option Link the input with an existing filter. Under the Select an existing filter menu, select the log field filter that you added to the dashboard earlier.

   Click Save Changes.

   Now you have linked both the widgets to the same filter for inputs.

5. Save the changes to the dashboard.

Now the new filter that you added to the dashboard and subsequently to both the widgets appears in the scope filter while viewing the dashboard. Any input value you provide in the filter, for example, Linux Syslog Logs, is immediately applied to both the widgets and the logs are filtered for that value.

You can configure input to your widget such that the value of the input is static and does not depend on other filters. In such cases, the input value is hard-coded into the widget.

This is typically required when the input is a one-time setup only for a specific widget in the dashboard and does not have to be shared across multiple widgets.

Let us consider the scenario where we have the widget fixed_input_demo which displays logs from multiple log sources. The query used for the widget is:

* | stats count as logrecords by 'Log Source' | sort -logrecords

If the widget must display logs only from the source Linux Secure Logs, then the parameter Log Source and its value Linux Secure Logs can be specified in the widget such that only the logs from the selected source are displayed.

1. Go to the Dashboards listing page, and click the one which must be edited. The Dashboard Details page opens. Click Actions, and click Edit.

2. Drag and drop the widget from the Widgets pane and Add widgets tab.

3. Go the Widgets pane, and click Edit Widgets. Here, you will see the widget that you had added earlier, for example, fixed_input_demo.

   Expand the widget to edit it. Click Add Input. The Configure Input.. dialog box opens.

   Select the option Specify the input. Provide the parameter name and its value, for example, Log Source and its value Linux Secure Logs.

   Click Save Changes.

4. Save the changes to the dashboard.

Now the widget displays logs only from the specified source. So the effective query for the widget is:

'Log Source' = 'Linux Secure Logs' | stats count as logrecords by 'Log Source' | sort -logrecords

To have fine-grain control over selecting inputs, you can nest the filters such that one filter receives input from the other, which can then be applied on the logs.

You would typically require this level of control when you have multiple values of fields in your large set of logs, and the individual values of the fields could be used for separate analysis. Also, in cases where you have a large composite network or infrastructure that you are collecting logs from, and would like to set up controls to drill down to specific logs.

Let us consider the scenario where the logs are collected from multiple sources and entity types. We now want to filter the logs by entity type first, and sources next. To achieve that, we must create a log field filter for the Entity Type field, create a log field filter for the Log Source field and link its input to the first filter. Then, the logs are first filtered by entity type depending on the value you select for the entity type in the scope filter. Next, the filtered logs are available to select the logs by source.

The following steps illustrate the process to set up the filters for the above scenario:

1. Go to the Dashboards listing page, and click the one which must be edited. The Dashboard Details page opens. Click Actions, and click Edit.

2. Create a log field filter with Entity Type field name. See Filter Example: Log Field.

   Go to Edit Filters tab and modify the label of the log field filter to Entity Type, if required.

3. Create a log field filter with Log Source field name. See Filter Example: Log Field.

   Go to Edit Filters tab and modify the label of the log field filter to Log Source, if required.

4. Go the Filters pane, and click Edit Filters. Here, you will see both the filters that you added earlier.

   Expand the log field filter for Log Source. Click Add Input. The Configure Input.. dialog box opens.

   Select the option Link the input with an existing filter. Select the entity type filter that you added earlier.

   Click Save Changes.

   Now you have linked the two filters successfully. The second filter for log source is now dependent on the first filter for entity type for the values. So, based on the value of the entity type, only those log sources appear in the second filter for selection that are applicable for the selected entity type.

   Add the second filter as the input to your widget to see the result of the filter input cascading.

5. Save the changes to the dashboard.

When you view the dashboard, in the scope filter, you can first select from the entity types, for example, Host (Linux). Next, from the filtered set of logs, you can select the values of log sources, for example, Linux Audit Logs, to view the final set of logs.

Note that, the options available for you to select from the second filter will depend on the selection of values in the first filter.

Log Field is one of the most powerful filters in Oracle Logging Analytics that enables you to specify any input from the range of fields available in your logs.

When you create a log field filter for a field, for example Entity Type, you are facilitating a new entity type input. This input can have multiple values, for example, Oracle Database Instance, WebLogic Server, Host (Linux), OCI API Gateway, etc.

In this example, we create a filter for the logs that are from entity type Host(Linux):

1. Go to the Dashboards listing page, and click the one which must be edited. The Dashboard Details page opens. Click Actions, and click Edit.

2. Click the Filters pane, and click Add Filters. From the list of Oracle-defined filters, click Log Field. Then the log field filter is added to the filters section of the dashboard.

   The Configure Log Group Compartment input dialog box opens.

3. Select the log group compartment from the available filters in your dashboard or add a new filter for it. Click Save Changes.

   The Configure Log Field Name input dialog box opens.

4. You can select from one of the three options to specify the log field name. For details about each option, see step 5 in Create a Custom Dashboard.

   In this example, to define an entity type filter, select the option Specify the Log Field Name input, and select the field name from the drop down menu. Select Entity Type.

   Click Save Changes.

5. Go to Edit Filters tab and modify the label of the log field filter, if required.

6. Drag and drop the widget from the Widgets pane and Add widgets tab.

   Go the Widgets pane, and click Edit Widgets. Here, you will see the widget that you had added earlier.

   Expand the widget to edit it. Click Add Input. The Configure Input.. dialog box opens.

   Select the option Link the input with an existing filter. Under the Select an existing filter menu, select the log field filter that you added to the dashboard earlier. When you select this option, you will be able to specify the field value when you visit the dashboard.

   However, if you want to fix the field value, then select the option Specify the input, and under Parameter Name, provide the exact log field name that you had selected earlier, for example, Entity Type. Under Enter a value, provide the value of the field that you want the logs to be filtered with, for example, Host(Linux).

   Click Save Changes.

   Now you have linked the widget to the log field filter for input.

7. Save the changes made to your dashboard.

Visit the dashboard to see the log field filter in the Scope Filters section. If you have not fixed the field value for the widget, then you can select from the options of the field value in the scope filter, and dynamically filter the logs used in the widget for analysis.