Dashboards & Visualizations

How to get all three dynamic drop-downs to interact with my panels and the field application?

JoshuaJohn
Contributor

I have a dynamic drop down that gives me a list of all apps on my device.
ie:
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

I want to create a static option in that dropdown with all apps that are on version 10.1, and another in that same dropdown for devices on 10.2

I need the search to be dynamic as I do not want to update this dashboard constantly for new apps/versions, but I am unable to enter a query into the static part of my dropdown... so I decided to create three dropdown menus

1) Original Dynamic DropDown
2 static options
-All 10.1 Apps (when selected shows DropDown 2)
-All 10.2 Apps (when selected shows DropDown 3)
Contains all apps

2) Dynamic DropDown (Contains 10.1 Apps)
Contains all apps for 10.1
Plus an All 10.1 apps option

3) 2) Dynamic DropDown (Contains 10.2 Apps)
Contains all apps for 10.2
Plus an All 10.2 apps option

So far when selecting any of these options in the new dropdowns they do not impact my board, my variables names are the same (Application for all of them)

| search "Application"="10.1 Apps"  //With the thought I selected 10.1 in dropdown menu 1
| eval Application=if(Application=="10.1 Apps", "$10_1_Apps$", Application)
| search "Application" "ComplianceState"=*  "Mac_Address"="*"
|chart limit=50 count over Application by ComplianceState
| fields - ComplianceState

Any ideas how I can get DropDown 2 and 3 to interact with my panels and the field Application?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9
0 Karma

JoshuaJohn
Contributor

Hmm so close, this gives me the option of *10.1 but when passing the token to the panel it is impacting it only passes *10.2 but I need it to pass "T-Zone" 10.1 OR "EzConvert 10.1" OR "IntMail 10.1"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...