Dashboards & Visualizations

Best way to have a dashboard radio selector for specific hosts or a sourcetype which is then used in a panel's search?

dougtoppin
Engager

I have a few dashboards where I set up radio buttons that let the user select which host to search for. The panels each have a host=$selectedHost at the start to constrain the search. This works well except we also have a few sourcetypes set up where some groups of hosts have been created.

I need a way on a dashboard to let the user select a specific host or select a sourcetype, but I can't think of a way to have the search in a panel do one or the other. By that I mean "(if $selectedHost!=null then host=$selectedHost) else (sourcetype=$selectedSourcetype) the rest of the search".

I suspect that there is a better way to do this in general and am looking for any tidbits on how best to select either from a list of hosts or a list of sourcetypes to constrain a search.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this (run anywhere example)

<form>
  <label>Radio</label>
  <fieldset submitButton="false">
    <input type="radio" token="selectedFilter">
      <label>Filter Selector</label>
      <choice value="sourcetype=splunkd">sourcetype=splunkd</choice>
      <choice value="source=*license_usage.log">source=*license_usage.log</choice>
      <default>sourcetype=splunkd</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $selectedFilter$ | head 10</query>
          <earliest>@d</earliest>
          <latest>now</latest>
        </search>
        <option name="type">list</option>
        <option name="count">10</option>
        <fields>["host","source","sourcetype"]</fields>
      </event>
    </panel>
  </row>
</form>
0 Karma

pradeepkumarg
Influencer

You can give two different drop downs and default them to *
if they select host, they will leave the sourcetype at * and if they select sourcetype they will leave host as *

host=host1 sourcetype=*

OR

host=* sourcetype=sourcetype1

Does this work for your case?

0 Karma

dougtoppin
Engager

The idea was helpful but I did it a little differently.

The host selector radio buttons had a field called hostVar and each one was set to a different hostname.

The change that I made was to add after each hostname value 'sourcetype=' so they look like this:
hostVar=host1 sourcetype=

I also added a new radio button for a sourcetype selection that has a value that looks like this:
sourcettype=mysourcetype hostVar=*

That panels already have this so the above works:
host=$hostVar$ my query

I'm not a pro at querying but the above seems to work.

tks for the suggestion

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...