Dashboards & Visualizations

How do I reference a dropdown menu label?

smashedpumpkins
Explorer

I've run into a few issues that are probably obvious to solve. First, I don't have the ability to install apps or drop/change CSS and JS files. So I'm stuck with Simple XML or the discouraged Advanced XML. (Unless I can do this in the GUI)

I don't see many people creating dashboards for this type of purpose. I have a dropdown menu with several choices each with a declared value of a unique search. I've read about searchTemplate and searchString but I have over 10 searches that are completely unique. It seems like the only way to have unique searches all referenced in a single dropdown menu is to declare the entire search in the choice value.

This however gives me all sorts of grief when I want to customize the drilldown options. When I drilldown, there doesn't seem to be a way to pass the "$click.value$" to the dropdown menu matching against the label not value.

Here's a code snippet to help explain. I have a dropdown menu, text box, and time input. From there, the user chooses from several different log types. In the text box the user specifies an IP or some other text. Once submitted two panels are populated. The first panel contains a search that will find all log types available based on the users specified search. The second panel displays the matched content and formats it based on the search contained in the dropdown menu.

This works great, but I want the user to then be able to drilldown from the metadata. I want the user to be able to click the metadata, pass the clicked value in the address bar, and reload the page with a new dropdown menu item selected based on the clicked value.

So to wrap all of this up; is there a way assign a name or id to each dropdown menu option, then pass the name through the address bar to search the form again?

 <form>
  <label>Searchable Forms</label>
  <fieldset>
    <input type="dropdown" token="logSource">
      <label>Logs</label>
      <default>FooFooFoo</default>
      <choice value="index=foofoofoo">FooFooFoo</choice>
      <choice value="index=foofoo">FooFoo</choice>
      <choice value="index=foo">Foo</choice>
      </input>
    <input type="text" token="search">
      <label>Search (e.g., source address or name)</label>
      <default>*</default>
      <seed>*</seed>
    </input>
    <input type="time">
      <default>Last 4 hours</default>
    </input>
  </fieldset>
  <row>
    <table>      
      <title>Metadata Discovery</title>
      <searchString>$search$ | PRE-DETERMINED SEARCH</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>      
      <drilldown>
      <link>
        <![CDATA[
        /app/xxx/xxxx?form.search=$search$&form.logSource=$click.value$
        ]]>
      </link>
</drilldown>
    </table>
  </row>
  <row>
    <table>
      <title>1st Log Source</title>
      <searchString>$search$ $logSource$</searchString>
      <earliestTime>$earliest$</earliestTime>
      <latestTime>$latest$</latestTime>
      <option name="drilldown">cell</option>
    </table>
  </row>
</form>
Tags (1)
0 Karma

smashedpumpkins
Explorer

I managed to get this working in a round about way. My drop down menu now populates values with a lookup table which contains every search. In my metadata panel using a conditional switch statement, I grouped each row by the drop down labels. I then piped the results with the lookup table where the labels matched the lookup labels and returned the search query.

This now allows the user to click the row and further drill down using the searches located in the lookup table/drop down menu.

0 Karma

smashedpumpkins
Explorer

Even if there's no direct solution to my problem, I would appreicate any recommendations as to a new way of accomplishing my task. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...