Auto population of form drop down values based on selected value in other drop down

[ramanjain1983]

Hi All,

I am trying to create a from in which the the first drop down is having host names. The second one is having the java process names on that host. Now I want to make a dependency link for the second one with the first drop down which means whatever value is getting selected in drop down which is host then the second drop down should show me the choices according to it (which means only the java process for that host and not for all).

Example:- First drop down : index=* | dedup host | table host

Second drop down : index=* host="$host" | re "...some variable capture | dedup that variable | table that variable

Now when I am doing this then parameter $host$ is not populating the respective value in the second drop down.

Any suggestions please. Not:- I am on Splunk 5.0.2.

Thanks in advance.

[somesoni2]

I believe you are looking for something like this. (in advanced xml)

<module name="Search">
    <param name="search">
     index=* | stats count by host
    </param>

    <!-- Start Pulldown - Host -->
    <module name="Pulldown">
            <param name="name">host</param>
            <param name="postProcess">fields host</param>
            <param name="label">Host:</param>           
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="label">host</param>
                    <param name="value">host</param>
                </list>
            </param>
            <!-- Start Pulldown - someVariable -->
            <module name="Search">
                <param name="search">
                 index=* host=$host$| .....|
            </param>
            <module name="Pulldown">
                <param name="name">someVariable</param>
                <param name="postProcess">fields someVariable</param>
                <param name="label">SomeVariable:</param>
                <param name="searchFieldsToDisplay">
                    <list>
                        <param name="label">someVariable</param>
                        <param name="value">someVariable</param>
                    </list>
                </param>

Hierarchy is the key.

[dstaulcu]

From Splunk Viz document:

The Splunk Dashboard Examples app
When it comes to learning dashboard and form design in all three formats--Splunk Web, simple XML, and advanced XML--the Splunk Dashboard. Examples app can be an invaluable resource. This app provides a cornucopia of dashboard and form examples of all ranges of complexity--more than 50 in all. Each example dashboard comes with a text explanation of how it works and a link to the dashboard source code. The Splunk Dashboard Examples app will come in handy whether you're a novice at simple XML or a seasoned expert with advanced XML. Go to Splunk Base to download the Splunk Dashboard Examples app and install it in your Splunk instance.

http://apps.splunk.com/app/1603/

Within app: Goto
Examples --> Form Input Elements --> Cascading form input