Dashboards & Visualizations

How edit my dashboard so that when an input is selected, the results of that input is displayed?

pavanae
Builder

I have a Dashboard row as follows

alt text

where search is as follows :-

My search

|stats avg(e) as a_e avg(l) as a_l  values(eval(if(days=1, e, null()))) as y_e values(eval(if(days=1, l, null()))) as y_l by user days 

How can I display the dashboard in such a way that I give the input of a user and then the result dashboard should be only for that user?

0 Karma
1 Solution

sundareshr
Legend

Add a dropdown for user and populate with distinct user list from your data. Like this

<input type="dropdown" token="user">
<search><query>index=foo sourcetype=bar | stats count by user | fields user</query></search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>

Then, user the user selection values, that is populated in token user in your second query as a filter criteria, like so

<table>
<search>index=foo user=$user$ | rest of your query here</query></search>
</table>

View solution in original post

0 Karma

sundareshr
Legend

Add a dropdown for user and populate with distinct user list from your data. Like this

<input type="dropdown" token="user">
<search><query>index=foo sourcetype=bar | stats count by user | fields user</query></search>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>

Then, user the user selection values, that is populated in token user in your second query as a filter criteria, like so

<table>
<search>index=foo user=$user$ | rest of your query here</query></search>
</table>
0 Karma

pavanae
Builder

Where exactly the following values need to be inserted in the html? @sundareshr

table
index=foo user=$user$ | rest of your query here
/table

0 Karma

sundareshr
Legend

This is the search query for showing data in your table, filtered by user value selected. So use this in your table panel.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...