Splunk Search

In a dashboard, how do you do a filter so that only certain values appear in the chart dropdown ?

kingwaras
Engager

Hi all,

I have created a dashboard as below.

But I had a problem during the chart generation.

When the first dropdown is selected ALL (*), I would like to see in my chart only the name filtered in the dropdown and not all value present in the index.

You can see below an image with an example. When I will select ALL, I would like to see only the two names showed in the dropdown and not all index value.

alt text

<form>
  <label>Users</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="NAME_ID" searchWhenChanged="true">
      <label>Towers</label>
      <choice value="*">ALL</choice>
      <fieldForLabel>name</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup.csv 
 | where Level > [| inputlookup hierarchy_lookup.csv  | 
          where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) | table accountname | rename accountname as Name] 
            | table Level | rename Level as search] | fields Name </query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="dropdown" token="MODULE_ID" searchWhenChanged="true">
      <label>Module</label>
      <choice value="*">ALL</choice>
      <default>*</default>
      <initialValue>*</initialValue>
      <fieldForLabel>capotorre</fieldForLabel>
      <fieldForValue>module</fieldForValue>
      <search>
        <query>| inputlookup hierarchy_lookup_module.csv | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module | dedup module | stats count by module</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>tok_ready_to_charge: $NAME_ID$&lt;br/&gt;
            | inputlookup hierarchy_lookup.csv | search Name= "$NAME_ID$" | dedup Team | table Team&lt;br/&gt;
            | inputlookup hierarchy_lookup_module.csv  | search Name=$NAME_ID$ | eval module=split(Module,";") | mvexpand module | table module&lt;br/&gt;
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Multi Value Search</title>
        <search>
          <query>index="effort_tracker"  $NAME_ID$ $MODULE_ID$ | stats count by Username</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </chart>
    </panel>
  </row>
</form>
Tags (2)
0 Karma
1 Solution

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>

View solution in original post

0 Karma

mykolaichuk
Engager

Hi,

You can include you input query in the chart search:

   <query> index="effort_tracker"
   ( ( [| inputlookup hierarchy_lookup.csv  | where Level > [| inputlookup hierarchy_lookup.csv 
        | where [| rest /services/authentication/current-context | eval accountname=mvindex(split(username,"@"),0) 
            | table accountname | rename accountname as Name] | table Level | rename Level as search] 
| fields Name | rename Name as Username]) AND Username=$NAME_ID$) $MODULE_ID$ 
| stats count by Username </query>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...