Hi all,
I'm trying to make a simple dropdown in splunk framework that visualize all my source.
What I'm suppose to insert in the block content, to visualize the dropdown?
And I would like use the results of the search instead of 1, 2, 3, How I can do this?
{% extends "splunkdj:base_with_app_bar.html" %}
{% load splunkmvc %}
{% block content %}
{% endblock content%}
{% block js %}
<script>
var deps = [
"splunkjs/ready!",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/dropdownview"
];
require(deps, function(mvc) {
var SearchManager = require("splunkjs/mvc/searchmanager");
new SearchManager({
id: "mysearch-log",
search: "index=waratek | stats dc(source) by source | eval rule=source | fields rule"
});
var DropdownView = require("splunkjs/mvc/dropdownview");
new DropdownView({
id: "drop-list",
default: "One",
el: $("#divToHangOn")
}).render();
var choices = [{label: " One", value: "One"},
{label:" Two", value: "Two"},
{label:" Three", value: "Three"}];
//I would like use the results of the search instead of this 3 values
//like=label:" Two", value: rule[2]
//like=label:" Three", value: rule[3]
splunkjs.mvc.Components.getInstance("drop-list").settings.set("choices", choices);
var sbg = splunkjs.mvc.Components.getInstance("drop-list");
var sbResult = document.getElementById("example-dropdown-result");
sbg.on("change", function(){
sbResult.innerHTML = sbg.val();
});
//write the drop-list click in a in a file
});
</script>
{% endblock js %}
Thank you
Please take a look at this
http://dev.splunk.com/view/SP-CAAAEN4 (On the right hand side, you have step by step instructions)
{block managers} will hold the search and {block content} will contain the type of visualization you want for the searches.
Also, are you looking for total # of sources in a index? or count of events per source ?
index=waratek|stats count as Events by source? Hope this helps
Thanks,
Raghav
Thank you for your reply, I would like create a dropdown menu to select " rul1 " or "rul2" or "rul3" that are all my source if I search index=waratek.
So yeah: index=waratek | stats dc(source) (And in splunk works perfectly, give me the correct results).
The problem is that If I create this query and next I try to make something like this:
{block content..
{% dropdown id="list" managerid="list-search" %}
and in search, or in the javascript code I add the query:
index=waratek | stats dc(source) by source | fields source
I'll obtain an error like"Duplicate labels causing conflict splunk"
So I'm trying with "var choices = [{label: " One", value: "One"},
{label:" Two", value: "Two"},
{label:" Three", value: "Three"}];"
But I would like use instead of these values (one, two..), the results of my previously query (rul1, rul2..)
And next take this value to create another query.
Please, how I can make this?
Thank you a mil