Dashboards & Visualizations

Multiple multiselects and panels

paviach
New Member

I have 3 multiselects and each dependent on one-another.
The third multiselect should display panels based on the selection.
How do I give multiple query and conditions?

eg.,
Multiselect A
Multiselect B is dependent on A
Multiselect C is dependent on B

Panel 1 is dependent on C's selection.

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:

Multiselect A (there's a field called fieldA):

| inputlookup lookupA.csv
| sort fieldA
| table fieldA

Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):

| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB

Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):

| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC

Ciao.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi paviach
you have to create the searches of multiselect B and C as a search with a token from the previous multiselects, e.g. something like this:

Multiselect A (there's a field called fieldA):

| inputlookup lookupA.csv
| sort fieldA
| table fieldA

Multiselect B (there are two fields called fieldB and keyB, where keyB is the field related to Multiselect A):

| inputlookup lookupB.csv WHERE keyB=$fieldA$
| sort fieldB
| table fieldB

Multiselect C (there are three fields called fieldC, keyCA and keyCB, where keyCA is the field related to Multiselect A and keyCB is the field related to Multiselect B):

| inputlookup lookupC.csv WHERE (keyCA=$fieldA$ AND keyCB=$fieldB$)
| sort fieldC
| table fieldC

Ciao.
Giuseppe

paviach
New Member

I have created 2 multiselects and the 2nd works with 1st multiselect's input. Now based on B's selection, I need to display a panel. How do I do it?

0 Karma

paviach
New Member

Could you please give me a working sample? Am completely new to Splunk and trying hard to make this multiselect work for panels.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi paviach
try this, only to see the approach:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="input1">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="input2">
      <label>Input2</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal $input1$ | dedup component | sort component | table component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>component="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal $input1$ $input2$</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...