Splunk Search

What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

dwalker1
New Member

Hi Folks,

I have a dashboard that automatically populates a drop-down based on a search with CDATA. I want to be able to actually type into the box, say a specific IP, and as I'm typing it, have it do an on-demand filter. The closest I've been able to do is a "multi-select" input instead of a drop-down. Does anyone know the easiest way to do this?

Thanks!

0 Karma

ngatchasandra
Builder

Hi,
In Splunk 6.2, this is possible . When you type for example a specific sourcetype in my case, the input will automatically filter the sourcetype who macth to that sourcetype. My XML code with CDATA! is:

<form>
  <label>Dashboard_Filter</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Select Sourcetype</label>
      <search>
        <query><![CDATA[index=_internal | table sourcetype]]></query>
      </search>
      <fieldForLabel>sourectype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

somesoni2
Revered Legend

For Splunk 6.1.X version, multiselect is option to get the dropdown with text field. This feature is available (brought back) in Splunk 6.2

0 Karma

dwalker1
New Member

Would you be able to only have it default to one selection?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...