Dashboards & Visualizations

Cannot create static or dynamic dropdowns for this search

andreshuexes
New Member

Hi all,

Since I'm a very recent Splunk user I found problems creating dropdowns for my dashboard compiling the Google bot hits to our domains

The data I want to get is coming from the search bellow, I'm interested in getting an area chart but being able also to filter with the dropdown each one of the host_names (domains of my company)

index=x_com_app user_agent = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" OR user_agent="Googlebot-Image/1.0" OR user_agent="Googlebot/2.1 (+http://www.google.com/bot.html)" OR user_agent = "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" host_name="www.x.com" OR host_name="www.x.com.cn" OR host_name="www.x.co.jp"| timechart span=1d count by host_name limit=10

Hope you can help me and thanks a lot in advance

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi andreshuexes,
you have to create a simple search with the list of the host_names, something like this:

index=x_com_app
| dudup host_names
| sort host_names
| table host_names

so you can create your dropdown list:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host_names">
      <label>host_names</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>host_names</fieldForLabel>
      <fieldForValue>host_names</fieldForValue>
      <search>
        <query>index=x_com_app
                      | dudup host_names
                      | sort host_names
                      | table host_names
        </query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>host_names="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>
                    index=x_com_app user_agent = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" OR user_agent="Googlebot-Image/1.0" OR user_agent="Googlebot/2.1 (+http://www.google.com/bot.html)" OR user_agent = "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" $host_name$
                  | timechart span=1d count by host_name limit=10
          </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

This is an example using search panel but you can use also other graphic panels.
In addition, instead of a dropdown menu, you could also use multiple choice inputs.

You can find useful examples in Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi andreshuexes,
you have to create a simple search with the list of the host_names, something like this:

index=x_com_app
| dudup host_names
| sort host_names
| table host_names

so you can create your dropdown list:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="host_names">
      <label>host_names</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>host_names</fieldForLabel>
      <fieldForValue>host_names</fieldForValue>
      <search>
        <query>index=x_com_app
                      | dudup host_names
                      | sort host_names
                      | table host_names
        </query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>host_names="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>
                    index=x_com_app user_agent = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" OR user_agent="Googlebot-Image/1.0" OR user_agent="Googlebot/2.1 (+http://www.google.com/bot.html)" OR user_agent = "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.96 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" $host_name$
                  | timechart span=1d count by host_name limit=10
          </query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="list.drilldown">none</option>
        <option name="list.wrap">1</option>
        <option name="maxLines">5</option>
        <option name="raw.drilldown">full</option>
        <option name="rowNumbers">0</option>
        <option name="table.drilldown">all</option>
        <option name="table.sortDirection">asc</option>
        <option name="table.wrap">1</option>
        <option name="type">list</option>
      </event>
    </panel>
  </row>
</form>

This is an example using search panel but you can use also other graphic panels.
In addition, instead of a dropdown menu, you could also use multiple choice inputs.

You can find useful examples in Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Ciao.
Giuseppe

0 Karma

andreshuexes
New Member

Hi Giusseppe,

Firstly thanks a lot for your reply, it worked, the dropdown is working!!

The only thing I cannot do is creating an area chart linked to the dropdown

Should I created a new search or is there a way to link the chart back?

Thanks again

Andres

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi andreshuexes,
what do you mean with "creating an area chart linked to the dropdown"?
You can create a chart in a panel that uses the drilldown as a filter using a token (in your example $host_name$), why you don't reach to do this?
Go in [Edit -- UI -- Select Visualization] and modify your visualization.
Beware that to do this you must have (as in your example) only streaming commands as stats, timechart or chart.

If this answer solved your problem, please, accept and/or upvote it.

Ciao.
Giuseppe

0 Karma

andreshuexes
New Member

Hi Guisseppe,

Exactly changing the visualization, I was playing around and seems to be okay

Thanks a lot!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...