Dashboards & Visualizations

Dynamically change "environments" using textbox

leomedina
Explorer

Hello all,

I am trying to dynamically change from environments (i.e. Dev, QA, Prod, etc.) using the textbox input. Can one create separate ones? I have two different indexed data sources in one dashboard. I tried this but it didn't work...

<input type="multiselect" token="environment" searchWhenChanged="true">
      <label>Select one or more environment(s):</label>
      <search>
       <query>| metadata (index=datapower OR index=tibco) type=environment
            | stats count by environment</query>
       <earliest>-24h@h</earliest>
       <latest>now</latest>
      </search>
      <fieldForLabel>Environment</fieldForLabel>
      <fieldForValue>Environment</fieldForValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valueSuffix>"</valueSuffix>
      <delimiter>OR</delimiter>
     </input>

Thanks for the feedback.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi leomedina,
try something like the "multiple inputs" example from Splunk 6.x Dashboard Examples App:

<input type="multiselect" token="environment" searchWhenChanged="true">
    <label>Select one or more environment(s):</label>
    <search>
        <query>
            | metadata (index=datapower OR index=tibco) type=environment
            | dedup environment
            | sort environment
            | table environment</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
    </search>
    <fieldForLabel>environment</fieldForLabel>
    <fieldForValue>environment</fieldForValue>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>environment="</valuePrefix>
    <valueSuffix>"</valueSuffix>
    <delimiter> OR </delimiter>
</input>

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...