Dashboards & Visualizations

How to get all three dynamic drop-downs to interact with my panels and the field application?

JoshuaJohn
Contributor

I have a dynamic drop down that gives me a list of all apps on my device.
ie:
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

I want to create a static option in that dropdown with all apps that are on version 10.1, and another in that same dropdown for devices on 10.2

I need the search to be dynamic as I do not want to update this dashboard constantly for new apps/versions, but I am unable to enter a query into the static part of my dropdown... so I decided to create three dropdown menus

1) Original Dynamic DropDown
2 static options
-All 10.1 Apps (when selected shows DropDown 2)
-All 10.2 Apps (when selected shows DropDown 3)
Contains all apps

2) Dynamic DropDown (Contains 10.1 Apps)
Contains all apps for 10.1
Plus an All 10.1 apps option

3) 2) Dynamic DropDown (Contains 10.2 Apps)
Contains all apps for 10.2
Plus an All 10.2 apps option

So far when selecting any of these options in the new dropdowns they do not impact my board, my variables names are the same (Application for all of them)

| search "Application"="10.1 Apps"  //With the thought I selected 10.1 in dropdown menu 1
| eval Application=if(Application=="10.1 Apps", "$10_1_Apps$", Application)
| search "Application" "ComplianceState"=*  "Mac_Address"="*"
|chart limit=50 count over Application by ComplianceState
| fields - ComplianceState

Any ideas how I can get DropDown 2 and 3 to interact with my panels and the field Application?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about you use something like this for your first dropdown.

Your current search for dropdown 1 which gives all products, say with field name 'Application'
| eval sortorder=1
| appendpipe [| rex field=Application "(?<Version>\d+\.\d+) | stats count by Version | eval Application="*".Version | table Application | eval sortorder=2]
| sort -sortorder Application | table Application

This will fill in your dropdown with values like this

*9.9
*10.1
*10.2
T-Zone 10.1
Runner 9.9
VerMone 10.2
EzConvert 10.1
IntMail 10.1
VPNconnect 9.9
0 Karma

JoshuaJohn
Contributor

Hmm so close, this gives me the option of *10.1 but when passing the token to the panel it is impacting it only passes *10.2 but I need it to pass "T-Zone" 10.1 OR "EzConvert 10.1" OR "IntMail 10.1"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...