How can I append a second chart drill down to an e...

andrewtrobec · ‎04-04-2017

Hello,

I'm trying to get a chart drill down to pass multiple values to a dashboard multiselect input. The scenario is that I have a column chart and the columns that I click on get added as filter criteria to the input. First we have the muliselect:

<input type="multiselect" token="token_tok">
  <label>Configuration Item</label>
  <delimiter> </delimiter>
  <choice value="Value 1">Value 1</choice>
  <choice value="Value 2">Value 2</choice>
  <choice value="Value 3">Value 3</choice>
</input>

Then with the column chart I have the following drill down code:

<drilldown>
  <set token="form.token_tok">$form.token_tok$,$click.value$</set>
</drilldown>

The idea is to have the drill down append the selected value so that the input updates with the values. I thought that maybe adding a , would cause the values to be parsed into the multiselect values, but this doesn't work. Instead I end up with a single invalid value consisting of the token value, a comma, and the value selected from the chart.

Is there a way of getting around my problem?

Thank you and best regards,

Andrew

mdelwaide · ‎04-04-2017

Hi Andrew,

Have you tried a background search to merge both token value? I did a small test on my local Splunk and it seems to be working.

<form>
  <label>test</label>
  <search>
    <query>| makeresults | eval merge="$value1$,$value2$"</query>
    <preview>
      <set token="valuemerge">$result.merge$</set>
    </preview>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="value1">
      <label>field1</label>
      <choice value="Test">Test</choice>
      <choice value="Test1">Test1</choice>
    </input>
    <input type="dropdown" token="value2">
      <label>field2</label>
      <choice value="Test2">Test2</choice>
      <choice value="Test3">Test3</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $value1$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $value2$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $valuemerge$
      </html>
    </panel>
  </row>
</form>

I've simulated both of your input with static dropdown, when both are set, the 3rd value (merge) is calculated.

Also when you change on of the inputs, the 3rd field is recalculated

Hope this will help you

Regards

M.

andrewtrobec · ‎04-04-2017

Hello, and thank you for taking the time.
i see what you've done, but what I'm trying to do is slightly different. Adding on to your example, what I'd like to do is have a multiselect input that when passed values (in this case "Test,Test3"), automatically parses them into the their individual values. The result would be:

The values Test and Test3 would be columns selected from a column chart. Is this possible?

Regards,

Andrew

mdelwaide · ‎04-06-2017

Hi Andrew,

It seems it's something you can't do out of the box, but I was able to populate a multiselect dropdown with tokens. But it's not possible to automatically populate the multiselect box with those value.

Although I found a javascript that allows you to automatically select the first value of your multiselect, maybe with a bit of coding you'll be able to arrange the code to automatically set all the available value to be selected.

Regards

M.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="value1">
      <label>field1</label>
      <choice value="Test">Test</choice>
      <choice value="Test1">Test1</choice>
    </input>
    <input type="dropdown" token="value2">
      <label>field2</label>
      <choice value="Test2">Test2</choice>
      <choice value="Test3">Test3</choice>
    </input>
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <search>
        <query>| makeresults | eval Title="$value1$,$value2$" | makemv delim="," Title | mvexpand Title | appendcols [| makeresults | eval Value = "$value1$,$value2$" | makemv delim="," Value | mvexpand Value] | fields Title,Value</query>
      </search>
      <fieldForLabel>Title</fieldForLabel>
      <fieldForValue>Value</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $value1$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $value2$
      </html>
    </panel>
  </row>
</form>

How can I append a second chart drill down to an existing input?

.conf24 | Registration Open!

ICYMI - Check out the latest releases of Splunk Edge Processor

Introducing the 2024 SplunkTrust!