Dashboards & Visualizations

How to set up 2 dynamic drop-downs on a Simple XML dashboard where values in one form change based on the other form input?

svemurilv
Path Finder

Hi,

Am very new to Splunk.
I have a dashboard with 2 drop-downs.
First drop-down contains hostnames like host1, host2

If I select the host1, then the input for the 2 drop-down must be queary1 and it will display the process names.
if I select the host2, then the input for the 2 drop-down must be queary2 and it will display the logs.

Dropdown1     Dropdown2
host1         ----- value1,value2, value3         earliest=-2d host=$host$ Process=AB_* 
host          ----- value4,value5, value6         host=$host$  source=*  

What is the simple xml code for this?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try. Dropdown1 will have static/hardcoded host name. Once change of selection of dropdown1, it will set another token with query to be executed in dropdown2, based on selected host (double-check the queries). The dropdown2 will the run the query set by dropdown1, in conjunction with selected host and return a valueField column whose values will be shown in dropdown2. You can now use $host$ from dropdown1 and $dropdown2_tok$ from dropdown2 (you can change the name of token per your need).

<form>
  <label>Use tokens with conditional input choices</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host">
      <label>Host</label>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <default>host1</default>
      <change>
        <condition label="host1">
          <set token="dropdown2_query">earliest=-2d Process=AB_*| stats count by Process | table Process| rename Process as valueField </set>
        </condition>
        <condition label="host2">
          <set token="dropdown2_query">  source=* | stats count by source | table source | rename source as valueField</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="dropdown2_tok">
      <label>Some Label Here</label>
      <selectFirstChoice>true</selectFirstChoice>
       <search>
          <query>
            host=$host$ $dropdown2_query$
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      <fieldForLabel>valueField<fieldForLabel>
      <fieldForValue>valueField<fieldForValue>
    </input>
  </fieldset>
...rest of the dashboard...

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try. Dropdown1 will have static/hardcoded host name. Once change of selection of dropdown1, it will set another token with query to be executed in dropdown2, based on selected host (double-check the queries). The dropdown2 will the run the query set by dropdown1, in conjunction with selected host and return a valueField column whose values will be shown in dropdown2. You can now use $host$ from dropdown1 and $dropdown2_tok$ from dropdown2 (you can change the name of token per your need).

<form>
  <label>Use tokens with conditional input choices</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host">
      <label>Host</label>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <default>host1</default>
      <change>
        <condition label="host1">
          <set token="dropdown2_query">earliest=-2d Process=AB_*| stats count by Process | table Process| rename Process as valueField </set>
        </condition>
        <condition label="host2">
          <set token="dropdown2_query">  source=* | stats count by source | table source | rename source as valueField</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="dropdown2_tok">
      <label>Some Label Here</label>
      <selectFirstChoice>true</selectFirstChoice>
       <search>
          <query>
            host=$host$ $dropdown2_query$
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      <fieldForLabel>valueField<fieldForLabel>
      <fieldForValue>valueField<fieldForValue>
    </input>
  </fieldset>
...rest of the dashboard...
0 Karma

svemurilv
Path Finder

Thanks! working

0 Karma

svemurilv
Path Finder

Thanks! its working good stuff

0 Karma

svemurilv
Path Finder

Thanks! its working good stuff

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So you want to populate dropdown 2 with list of distinct 'Process' if host1 (hardcoded value) is selected and populate with list of distinct 'source if host2 is selected? Are you using the value of dropdown1 (host) anywhere else in the dashboard OR it's only used to determine content of dropdown2?

0 Karma

svemurilv
Path Finder

Hi, am using the host(dropdown1) in almost all the dashboard panels, also am using the process and source also in all panels.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...