Dashboards & Visualizations

How do you create a dropdown with 3 different source types to display a graph per source type?

splunkuseradmin
Path Finder

hi all,

I am trying to create a dropdown with 3 different source types to display a graph per source type.
If I try to change the source type, the graph doesn't show up.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@splunkuseradmin,

In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards and can't be renamed to a single value. i.e. rename *something as otherthing wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this

Changes are highlighted by comments

<form>
  <label>Drilldown</label>
  <fieldset submitButton="false">
   <input type="time" token="field1" searchWhenChanged="true">
   <label>Select Time</label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>
 <input type="dropdown" token="host" searchWhenChanged="true">
   <label>Select Host</label>
   <search>
     <query/>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
   <choice value="&quot;usac2-photos01.example.com-too_small&quot;">"usac2-photos01.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos02.example.com-too_small&quot;">"usac2-photos02.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos03.example.com-too_small&quot;">"usac2-photos03.example.com-too_small"</choice>
 </input>
  </fieldset>
  <row>
 <panel>
   <title>Photos Count of Url Hits</title>
   <chart>
     <search>
        <!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
          <query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)" 
         | timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0 
         <!-----------COMMENT : Substituted tokens in the rename ---------->
         | rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
         | eval "totalhits" = jp_200_hits+jp_404_hits
         | table _time jp_200_hits jp_404_hits totalhits</query>
                   <earliest>$field1.earliest$</earliest>
                   <latest>$field1.latest$</latest>
                   <sampleRatio>1</sampleRatio>
         </search>
       </chart>
     </panel>
</row>     
</form>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@splunkuseradmin,

In the rename and eval you are not using the tokens but string values. Also your drop down values are wildcards and can't be renamed to a single value. i.e. rename *something as otherthing wont work
If you have only two fields in the final result i.e. jp_200_* and jp_404_*, try this

Changes are highlighted by comments

<form>
  <label>Drilldown</label>
  <fieldset submitButton="false">
   <input type="time" token="field1" searchWhenChanged="true">
   <label>Select Time</label>
   <default>
     <earliest>0</earliest>
     <latest></latest>
   </default>
 </input>
 <input type="dropdown" token="host" searchWhenChanged="true">
   <label>Select Host</label>
   <search>
     <query/>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <!------ COMMENT : Changed sourcetype from wild cards to single value ---------->
   <choice value="&quot;usac2-photos01.example.com-too_small&quot;">"usac2-photos01.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos02.example.com-too_small&quot;">"usac2-photos02.example.com-too_small"</choice>
   <choice value="&quot;usac2-photos03.example.com-too_small&quot;">"usac2-photos03.example.com-too_small"</choice>
 </input>
  </fieldset>
  <row>
 <panel>
   <title>Photos Count of Url Hits</title>
   <chart>
     <search>
        <!---------- COMMENT : Changed sourcetype=*$host$ from $host$ ---------->
          <query>index=test_jp sourcetype="*$host$" | rex "(?i)^(?P<jp_hits>.+)" 
         | timechart span=1h eval(avg(jp_hits)) by sourcetype useother=f limit=0 
         <!-----------COMMENT : Substituted tokens in the rename ---------->
         | rename jp_200_$host$ as jp_200_hits, jp_404_$host$ as jp_404_hits
         | eval "totalhits" = jp_200_hits+jp_404_hits
         | table _time jp_200_hits jp_404_hits totalhits</query>
                   <earliest>$field1.earliest$</earliest>
                   <latest>$field1.latest$</latest>
                   <sampleRatio>1</sampleRatio>
         </search>
       </chart>
     </panel>
</row>     
</form>
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...