Dynamic dashboard drop-down

asparaguscookie — Fri, 09 Jul 2021 20:08:22 GMT

Hi Splunkers,
Long time listener, first time caller. I am trying to figure out how to make a dashboard based on a monthly vulnerability scan.
Our previous implementation was using relative dates to generate a dashboard, but that was highly dependent on everything going right.
I copy/pasted my way to a mostly-working dashboard from this community. Hoping I can get some help to get the rest of the way there.

The new implementation uses a ScanID from the report.csv.
My dashboard has a drop-down which doesn't let me select anything, but automatically selects the latest scanID (and dynamically assigns the previous month's ScanIDs for comparison/trendlines). I'd like to be able to use the drop down to review last month's report as well though.

Examples:

ScanID's:
This month: 999999
Last month: 888888
Previous Month: 777777
etc.

So as it stands the dashboard automatically performs a search and assigns the following tokens:
<set token="Scan1">$result.row 1$</set>
<set token="Scan2">$result.row 2$</set>
<set token="Scan3">$result.row 3$</set>
<set token="Scan4">$result.row 4$</set>

I'd like to be able to click the drop-down and select ScanID 888888 and have it automatically assign the token to "Scan1", and dynamically set "Scan2" to ScanID 777777 and so on.

Hope I've explained it well enough. Below is my sample (anonymized dashboard xml/source). Thanks in advance!

<form theme="dark"> <label>dropdown dashboard</label> <fieldset submitButton="false" autoRun="true"> <input type="dropdown" token="Scan1" searchWhenChanged="true"> <label>Select a Report</label> <search> <query>index="fakeindex" | dedup ScanID | table ScanID | head 6 | sort - ScanID | transpose </query> <earliest>-6mon@mon</earliest> <latest>now</latest> <done> <set token="Scan1">$result.row 1$</set> <set token="Scan2">$result.row 2$</set> <set token="Scan3">$result.row 3$</set> <set token="Scan4">$result.row 4$</set> </done> </search> </input> </fieldset> <row> <panel> <title>Panel for Debugging Token:</title> <html> Upercase $ScanX$ <div>This Month: $Scan1$</div> <div>Last Month: $Scan2$</div> <div>Prev Month: $Scan3$</div> </html> </panel> </row>

[example search that required multiple scanID's]

<single> <search> <query>index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan2$ NOT [ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan3$ | stats count by somevalue | table somevalue] | dedup somevalue ScanID | stats count(somevalue) as EVENTS | eval period="Last Month" | append [ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan1$ NOT [ search index="fakeindex" sourcetype=fakesourcetype ScanID=$Scan2$ | stats count by somevalue | table somevalue] | dedup somevalue ScanID | stats count(somevalue) as EVENTS | eval period="This Month" ] | fields EVENTS period _time</query> <earliest>-6mos@mos</earliest> <latest>now</latest> <sampleRatio>1</sampleRatio> </search> <option name="colorBy">trend</option> <option name="colorMode">none</option> <option name="drilldown">none</option> <option name="numberPrecision">0</option> <option name="rangeColors">["0x53a051","0x0877a6","0xf8be34","0xf1813f","0xdc4e41"]</option> <option name="rangeValues">[0,30,70,100]</option> <option name="refresh.display">progressbar</option> <option name="showSparkline">1</option> <option name="showTrendIndicator">1</option> <option name="trellis.enabled">0</option> <option name="trellis.scales.shared">1</option> <option name="trellis.size">medium</option> <option name="trendColorInterpretation">inverse</option> <option name="trendDisplayMode">absolute</option> <option name="underLabel">New</option> <option name="unitPosition">before</option> <option name="useColors">1</option> <option name="useThousandSeparators">1</option> </single>

topic Dynamic dashboard drop-down in Splunk Enterprise

Dynamic dashboard drop-down