How to set up 2 dynamic drop-downs on a Simple XML dashboard where values in one form change based on the other form input?

[svemurilv]

Hi,

Am very new to Splunk.
I have a dashboard with 2 drop-downs.
First drop-down contains hostnames like host1, host2

If I select the host1, then the input for the 2 drop-down must be queary1 and it will display the process names.
if I select the host2, then the input for the 2 drop-down must be queary2 and it will display the logs.

Dropdown1     Dropdown2
host1         ----- value1,value2, value3         earliest=-2d host=$host$ Process=AB_* 
host          ----- value4,value5, value6         host=$host$  source=*  

What is the simple xml code for this?

[somesoni2 · Accepted solution]

Give this a try. Dropdown1 will have static/hardcoded host name. Once change of selection of dropdown1, it will set another token with query to be executed in dropdown2, based on selected host (double-check the queries). The dropdown2 will the run the query set by dropdown1, in conjunction with selected host and return a valueField column whose values will be shown in dropdown2. You can now use $host$ from dropdown1 and $dropdown2_tok$ from dropdown2 (you can change the name of token per your need).

<form>
  <label>Use tokens with conditional input choices</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host">
      <label>Host</label>
      <choice value="host1">host1</choice>
      <choice value="host2">host2</choice>
      <default>host1</default>
      <change>
        <condition label="host1">
          <set token="dropdown2_query">earliest=-2d Process=AB_*| stats count by Process | table Process| rename Process as valueField </set>
        </condition>
        <condition label="host2">
          <set token="dropdown2_query">  source=* | stats count by source | table source | rename source as valueField</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="dropdown2_tok">
      <label>Some Label Here</label>
      <selectFirstChoice>true</selectFirstChoice>
       <search>
          <query>
            host=$host$ $dropdown2_query$
          </query>
            <earliest>-7d</earliest>
            <latest>-0d</latest>
        </search>
      <fieldForLabel>valueField<fieldForLabel>
      <fieldForValue>valueField<fieldForValue>
    </input>
  </fieldset>
...rest of the dashboard...

[svemurilv]

Thanks! working

[svemurilv]

Thanks! its working good stuff

[svemurilv]

Thanks! its working good stuff

[somesoni2]

So you want to populate dropdown 2 with list of distinct 'Process' if host1 (hardcoded value) is selected and populate with list of distinct 'source if host2 is selected? Are you using the value of dropdown1 (host) anywhere else in the dashboard OR it's only used to determine content of dropdown2?

[svemurilv]

Hi, am using the host(dropdown1) in almost all the dashboard panels, also am using the process and source also in all panels.