Dashboards & Visualizations

Populate dropdown without clicking a first time on the submit button

csimonnet
New Member

Hi everyone,

I have a dashboard with dropdowns with dynamic options and a submit button to run my searches. But my dropdowns are not populated if I don't click on the submit button a first time. How can I change that ?

Thank you for your answers

0 Karma

rbechtold
Communicator

Hey csimonnet,

Have you tried adding the token from your dropdown to your base search?
I made a quick dashboard using makeresults to illustrate the concept:

<form>
  <label>testdash</label>
  <search id="primary">
    <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", "")))))  
| search $dynamic_dropdown$
</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="true" autoRun="true">
    <input type="dropdown" token="dynamic_dropdown" searchWhenChanged="true">
      <label>Animal Types</label>
      <choice value="dynamic_field=*">all</choice>
      <default>dynamic_field=*</default>
      <initialValue>dynamic_field=*</initialValue>
      <fieldForLabel>dynamic_field</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <search>
        <query>|makeresults count=100
| eval logtype = random()%5
| eval dynamic_field = if(logtype = 0, "dogs", if(logtype = 1, "cats", if(logtype = 2, "lizards", if(logtype = 3, "snakes", if(logtype = 4, "bears", ""))))) 
| dedup dynamic_field 
| sort dynamic_field 
| eval value="dynamic_field=".dynamic_field</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search base="primary">
          <query>|stats count</query>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
  </row>
</form>

Let me break it down:

<search id="primary"> defines your base search. This search will populate all of your other panels based on this high level search.
Typically this search will look something like:
index=your_index sourcetype=your_sourcetype source=your_source | fields field1 field2 field3

You call on this search by adding <search_base="primary"> to any panel that would would like to build on from the base search.
You can see an example of this in the dashboard above:

<search base="primary">
 <query>|stats count</query>
</search>

Notice how the <query> is very small, that's because it's taking the base search as a starting point and adding onto it.

Lastly, notice in the example dashboard I've added |search $dynamic_dropdown$ to my base search. This is a reference to the token that dynamically populates the dropdown with the values from my search. Without this, your dropdown won't have any effects on your dashboard.

The only other thing I can think of to add is the searchWhenChanged="true" option. If you would like your dashboard to only populate when the submit button is pushed, change this to false.

Hopefully this helps.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you post the <fieldset section of your dashboard? Do remember to format the code using "101010" button on top of the text editor here OR select the code and press Ctrl+K.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...