Splunk Search

What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

dwalker1
New Member

Hi Folks,

I have a dashboard that automatically populates a drop-down based on a search with CDATA. I want to be able to actually type into the box, say a specific IP, and as I'm typing it, have it do an on-demand filter. The closest I've been able to do is a "multi-select" input instead of a drop-down. Does anyone know the easiest way to do this?

Thanks!

0 Karma

ngatchasandra
Builder

Hi,
In Splunk 6.2, this is possible . When you type for example a specific sourcetype in my case, the input will automatically filter the sourcetype who macth to that sourcetype. My XML code with CDATA! is:

<form>
  <label>Dashboard_Filter</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Select Sourcetype</label>
      <search>
        <query><![CDATA[index=_internal | table sourcetype]]></query>
      </search>
      <fieldForLabel>sourectype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>
0 Karma

somesoni2
Revered Legend

For Splunk 6.1.X version, multiselect is option to get the dropdown with text field. This feature is available (brought back) in Splunk 6.2

0 Karma

dwalker1
New Member

Would you be able to only have it default to one selection?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...