Hi,
So I have a dashboard that returns server metrics that has several parameters that I want to search by,
What I am looking to add is another drop-down input that allows me to look up servers according their server TYPE (e.g. App Server, Web Server, Database), after choosing token values for the other previously mentioned drop-down inputs. How do I go about making this happen?
We had similar issue in recent past , the issue was resolved by passing $value$.
Ex-
$token1$=$token2$ (this is going to take previous set value of token2 as you faced)
instead use $value$
$value$
Hope this helps
A careful read of this will answer all of your questions:
http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/tokens
But here is a simple example too:
<input type="dropdown" token="application" searchWhenChanged="true">
<label>Select an Application</label>
<choice value="*">All</choice>
<search>
<query>index=yourIndex application=*|dedup application | table application</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<fieldForLabel>application</fieldForLabel>
<fieldForValue>application</fieldForValue>
<prefix>application="</prefix>
<suffix>"</suffix>
<default>*</default>
</input>
<input type="dropdown" token="environment" searchWhenChanged="true">
<label>Select an Environment</label>
<choice value="*">All</choice>
<search>
<query>index=yourIndex $application$ environment=* |dedup environment | table environment</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<fieldForLabel>environment</fieldForLabel>
<fieldForValue>environment</fieldForValue>
<prefix>environment="</prefix>
<suffix>"</suffix>
<default>*</default>
</input>