All Apps and Add-ons

Passing values from one Pulldown to another

vaishnavi07
Explorer




2
*
False

<!-- Drop down for sourcetype -->


index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype


sourcetype
sourcetype
left

sourcetype

</module>

<!-- Drop down for counter -->


index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="\b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)

column
column

column


In the above code the first pulldown value sourcetype is not getting passed to the second pulldown module. $sourcetype$ is not getting the value. I dunno if am missing anyhthing. Does anyone know how to solve this issue?

Thanks in advance.

sideview
SplunkTrust
SplunkTrust

You need to nest the second Pulldown inside the first. In module-framework-speak, the second Pulldown needs to be "downstream" from the first. If this isn't a familiar concept to you yet, take a few minutes to read the "Introduction to the Advanced XML" page in Sideview Utils and all will be explained. Or at least much.

In combining these I also consolidated your "autoRun" attributes. Also take special care to never nest a module with autoRun=True inside another module with autoRun="True".

<module name="Search" layoutpanel="viewHeader" autoRun="True">
  <param name="search">
    index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype
  </param>
  <module name="Pulldown">
    <param name="name">sourcetype</param>
    <param name="label">sourcetype</param>
    <param name="float">left</param>
    <param name="staticOptions"/>
    <param name="valueField">sourcetype</param>
  </module>

  <module name="Search">
    <param name="search">index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)</param>
    <module name="Pulldown">
      <param name="name">column</param>
      <param name="label">column</param>
      <param name="staticOptions"/>
      <param name="valueField">column</param>
    </module>
  </module>
</view>
0 Karma

somesoni2
Revered Legend

The second pulldown module should be nested within first pulldown module.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...