Dashboards & Visualizations

Populate second drop down based on first drop down selection ?

vikas_gopal
Builder

Hi Experts,

I have one static drop down , it has 2 static value "stage and Prod". Now I want to display values in the second drop down based on first drop down selection . So second drop down shows staging servers only if first selection was stage and vice versa.

to be more specific
If Drop down 1 = stage
Drop down 2 = abc_stage1,abc_stage2 (using a query )

IF Drop down 2 = prod
Drop down 2 = abc_prod1,abc_prod2 (using a query )

Please help

VG

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

View solution in original post

DDivagarInfant
Engager

Can you share the soluition?

0 Karma

woodcock
Esteemed Legend

I agree with the other answer but to answer your literal question, try code like this:

<input type="text" token="server_partial" searchWhenChanged="false">
    <label>RegEx filter for Server Dropdown --&gt;</label>
    <default>.</default>
</input>
<input type="dropdown" token="server" searchWhenChanged="false">
    <label>(&lt;-- filtered) Server Selector:</label>
    <default>*</default>
    <choice value="*">All</choice>
    <fieldForLabel>server</fieldForLabel>
    <fieldForValue>server</fieldForValue>
    <search>
        <query>| inputcsv serverlist.csv | regex server="(?i)$server_partial$" | table server</query>
        <earliest>-1s</earliest>
        <latest>now</latest>
    </search>
</input>
0 Karma

vikas_gopal
Builder

I can see all staging servers have stage string in it and all prod has prod string in the server name .

0 Karma

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

vikas_gopal
Builder

Thank you Man,

Works like charm.

jkat54
SplunkTrust
SplunkTrust

A lot of people prefer to use | metadata type=hosts instead of index=AIndexWithAllHosts

0 Karma

vikas_gopal
Builder

Got another situation , now I am preparing a table based on above 2 inputs . When it is stage + All in second I want to see only stage servers in the table below . What it is doing in table is, it is giving me overall servers details that is for both stage and prod . For table I tried this but with this no data appears

index=abc  source=computer host=$host$ $env$| sort Name  |table Name,Domain, Manufacturer, Model|dedup Name,Domain, Manufacturer, Mode

I know this is because of $env$ as it is searching for P or S.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...