Hello, I have a timechart search (search code snippet below), everything works great. The chart shows up and the legend shows "sample1", "sample2" . What I would like to do is, Instead these of the static names I would like to put in a variable name, for example, $location$, but when I put $location$ in replacing sample2 I get the literal text "$location$" in my legend, sorry for such a newbie question but we are muddling our way through. | search siteid=$siteid$ location=$location$ | timechart avg("powerdata{}.sample1{}.current") assample1, avg("powerdata{}.sample2{}.current") as sample2 | eval sample1=round(sample1,2) | eval sample2=round(sample2,2) ... View more

Hello all, We have some custom JSON data getting in to Splunk. We are also creating some dashboards with this data. Everything is working great, except for drop down boxes. In our data, (below), we have JSON coming from two different devices, one has a plugcount of 8 and another has a plugcount of 4. In our dropdown we are reading the JSON values, the listbox shows values of 8, and 4 as the only selections (as expected). What I would like to do is show all selections for the numbers in between, from 1 to the maximum read also (i.e. 1,2,3,4,5,6,7,8). Could anyone point me in the right direction ? Thanks. JSON CODE sent to Splunk { "sourcetype": "powerdata", "event": { "timestamp": "2019-05-22T17:14:53+00:00", "siteid": "OFFICE158RACK", "assettag": "DEVICECPM16", "branchcount": "4", "plugcount": "8", } } { "sourcetype": "powerdata", "event": { "timestamp": "2019-05-22T17:14:55+00:00", "siteid": "OFFICE158RACK", "assettag": "DEVICEVMR8", "branchcount": "2", "plugcount": "4", } } ... View more