Dashboards & Visualizations

how to add dropdown field to advanced view?

imrago
Contributor

I could not find an example for adding a dropdown field in advanced view.

In my advanced view I would like to replace the regular input field with a drowpdown holding the field names on which the user can execute searches. Example: User selects B_NUMBER in dropdown and in the input field types 02155555.

(B_NUMBER="02155555" to search)

Currently I use the following view to search on 2 fields.

<view template="dashboard.html"  onunloadCancelJobs="False" autoCancelInterval="100">  
    <label>client custom search</label>
    <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="true">
        <param name="search">search host=client_transformed index=client  A_NUMBER=$anum$ B_NUMBER=$bnum$ | fields I/O  A_NUMBER A_NUMBER_NAMED  B_NUMBER B_NUMBER_NAMED DATE TIME LOCATION BAND DURATION CPM  ex_vatcharge  | fields - _time</param>
        <module name="ExtendedFieldSearch">
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="anum">
                        <param name="default">*</param>
                    </param>
                </param>
            </param>
            <param name="replacementMap">
                <param name="arg">
                    <param name="anum">
                        <param name="value"></param>
                    </param>
                </param>
            </param>
            <param name="field">ANUMBER</param>
            <module name="ExtendedFieldSearch">
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="bnum">
                            <param name="default">*</param>
                        </param>
                    </param>
                </param>
                <param name="replacementMap">
                    <param name="arg">
                        <param name="bnum">
                            <param name="value"></param>
                        </param>
                    </param>
                </param>
                <param name="field">BNUMBER</param>
                <module name="Paginator">
                    <param name="count">20</param>
                    <param name="entityName">results</param>
                    <param name="maxPages">10</param>
                    <module name="SimpleResultsTable">
                    </module>
                </module>
            </module>
        </module>
    </module>
</view>
Tags (1)

Wushu
Explorer

If you want two columns then you need to look at the attribute 'layoutPanel'

e.g

then do for two columns you need another two with the following;

layoutPanel="panel_row2_col1"
layoutPanel="panel_row2_col1"

0 Karma

klee310
Communicator

The reason i am using advanced XML is because I want to have this form-search on the left column of my dashboard, and another form-search on the right column. Or is there another way to do this (2 columns dashboard) without using advanced xml?

0 Karma

emma
Splunk Employee
Splunk Employee

First off, I'm curious about why you're trying to do this in the advanced XML? It's much easier in the simplified XML but there might be something specific you're trying to accomplish by using the advanced XML. What is that?

Now, to answer your question. If I take one of the simplified XML views from the UI examples that includes dropdowns, then append ?showsource=true to the URI, I can see the advanced XML behind the dropdowns. It looks like:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
 <label>Simple select drop down</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="HiddenSearch" layoutPanel="viewHeader">
    <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</param>
    <param name="earliest">-30d</param>
    <param name="latest">-0d</param>
      <module name="SearchSelectLister">
        <param name="staticFieldsToDisplay">
         <list>
          <param name="value">*</param>
          <param name="label">Any</param>
         </list>
       </param>
       <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series</param>
       <param name="label">Select series</param>
       <param name="settingToCreate">series_setting</param>
       <param name="searchFieldsToDisplay">
        <list>
         <param name="value">series</param>
         <param name="label">series</param>
        </list>
       </param>
       <param name="searchWhenChanged">False</param>
        <module name="ConvertToIntention">
         <param name="settingToConvert">series_setting</param>
         <param name="intention">
           <param name="name">stringreplace</param>
           <param name="arg">
             <param name="series">
              <param name="fillOnEmpty">True</param>
              <param name="value">$target$</param>
            </param>
          </param>
         </param>
         <module name="SubmitButton">
          <param name="allowSoftSubmit">True</param>
          <param name="label">Search</param>
           <module name="JobStatus">
            <module name="EnablePreview" layoutPanel="panel_row1_col1" group="Matching events">
             <param name="groupLabel">Matching events</param>
             <param name="enable">True</param>
             <param name="display">False</param>
              <module name="SimpleResultsTable">
               <param name="count">50</param>
               <param name="drilldown">row</param>
               <param name="allowTransformedFieldSelect">True</param>
                <module name="ConvertToDrilldownSearch">
                 <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                 </module>
                </module>
              </module>
             <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
             </module>
        </module>
      </module>
    </module>
  </module>
</module>

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...