Solved: In a dashboard, how do you do a filter so that onl...

kingwaras · ‎11-30-2018

Hi all,

I have created a dashboard as below.

But I had a problem during the chart generation.

When the first dropdown is selected ALL (*), I would like to see in my chart only the name filtered in the dropdown and not all value present in the index.

You can see below an image with an example. When I will select ALL, I would like to see only the two names showed in the dropdown and not all index value.

<form>
  <label>Users</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="NAME_ID" searchWhenChanged="true">
      <label>Towers</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup.csv 
 | where Level > [| inputlookup hierarchy_lookup.csv  | 
          where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) | table accountname | rename accountname as Name] 
            | table Level | rename Level as search] | fields Name </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="MODULE_ID" searchWhenChanged="true">
      <label>Module</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>capotorre</fieldForLabel>
      <fieldForValue>module</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup_module.csv | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module | dedup module | stats count by module</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>tok_ready_to_charge: $NAME_ID$&lt;br/&gt;
            | inputlookup hierarchy_lookup.csv | search Name= "$NAME_ID$" | dedup Team | table Team&lt;br/&gt;
            | inputlookup hierarchy_lookup_module.csv  | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module&lt;br/&gt;
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Multi Value Search</title>
        <search>
          <query>index="effort_tracker"  $NAME_ID$ $MODULE_ID$ | stats count by Username</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </chart>
    </panel>
  </row>
</form>

mykolaichuk · ‎11-30-2018

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>

View solution in original post

mykolaichuk · ‎11-30-2018

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>

In a dashboard, how do you do a filter so that only certain values appear in the chart dropdown ?

Announcing Scheduled Export GA for Dashboard Studio

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!