All Apps and Add-ons

Passing values from one Pulldown to another

vaishnavi07
Explorer




2
*
False

<!-- Drop down for sourcetype -->


index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype


sourcetype
sourcetype
left

sourcetype

</module>

<!-- Drop down for counter -->


index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="\b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)

column
column

column


In the above code the first pulldown value sourcetype is not getting passed to the second pulldown module. $sourcetype$ is not getting the value. I dunno if am missing anyhthing. Does anyone know how to solve this issue?

Thanks in advance.

sideview
SplunkTrust
SplunkTrust

You need to nest the second Pulldown inside the first. In module-framework-speak, the second Pulldown needs to be "downstream" from the first. If this isn't a familiar concept to you yet, take a few minutes to read the "Introduction to the Advanced XML" page in Sideview Utils and all will be explained. Or at least much.

In combining these I also consolidated your "autoRun" attributes. Also take special care to never nest a module with autoRun=True inside another module with autoRun="True".

<module name="Search" layoutpanel="viewHeader" autoRun="True">
  <param name="search">
    index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype
  </param>
  <module name="Pulldown">
    <param name="name">sourcetype</param>
    <param name="label">sourcetype</param>
    <param name="float">left</param>
    <param name="staticOptions"/>
    <param name="valueField">sourcetype</param>
  </module>

  <module name="Search">
    <param name="search">index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)</param>
    <module name="Pulldown">
      <param name="name">column</param>
      <param name="label">column</param>
      <param name="staticOptions"/>
      <param name="valueField">column</param>
    </module>
  </module>
</view>
0 Karma

somesoni2
Revered Legend

The second pulldown module should be nested within first pulldown module.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...