<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: filter a table in a dashboard from textbox in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293175#M55814</link>
    <description>&lt;P&gt;HI&lt;/P&gt;

&lt;P&gt;I have tried same in XML. Can you please try it?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;init&amp;gt;
    &amp;lt;set token="form.tkn_make"&amp;gt;&amp;lt;/set&amp;gt;
    &amp;lt;set token="form.tkn_model"&amp;gt;&amp;lt;/set&amp;gt;
  &amp;lt;/init&amp;gt;
  &amp;lt;label&amp;gt;filter a table in a dashboard from textbox&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="text" token="tkn_make" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Make&amp;lt;/label&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="text" token="tkn_model" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Model&amp;lt;/label&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) &amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
    <pubDate>Wed, 22 Nov 2017 17:51:34 GMT</pubDate>
    <dc:creator>kamlesh_vaghela</dc:creator>
    <dc:date>2017-11-22T17:51:34Z</dc:date>
    <item>
      <title>filter a table in a dashboard from textbox</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293173#M55812</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.&lt;/P&gt;

&lt;P&gt;For example:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;search&amp;gt; | table ID Make Model Year
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make. &lt;/P&gt;

&lt;P&gt;Thank you for any insights!&lt;/P&gt;</description>
      <pubDate>Wed, 22 Nov 2017 13:19:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293173#M55812</guid>
      <dc:creator>behudelson</dc:creator>
      <dc:date>2017-11-22T13:19:29Z</dc:date>
    </item>
    <item>
      <title>Re: filter a table in a dashboard from textbox</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293174#M55813</link>
      <description>&lt;P&gt;You'll want to review the &lt;A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/Buildandeditforms"&gt;Form Examples&lt;/A&gt; section of the &lt;A href="http://docs.splunk.com/Documentation/Splunk/7.0.0/Viz/Aboutthismanual"&gt;Dashboards and Visualizations manual&lt;/A&gt;.  I think most of that ought to be reasonably easy if you follow the docs.  &lt;/P&gt;

&lt;P&gt;If you get part way throughthat and have problems or questions, ask away!&lt;/P&gt;</description>
      <pubDate>Wed, 22 Nov 2017 14:25:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293174#M55813</guid>
      <dc:creator>Richfez</dc:creator>
      <dc:date>2017-11-22T14:25:40Z</dc:date>
    </item>
    <item>
      <title>Re: filter a table in a dashboard from textbox</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293175#M55814</link>
      <description>&lt;P&gt;HI&lt;/P&gt;

&lt;P&gt;I have tried same in XML. Can you please try it?&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;init&amp;gt;
    &amp;lt;set token="form.tkn_make"&amp;gt;&amp;lt;/set&amp;gt;
    &amp;lt;set token="form.tkn_model"&amp;gt;&amp;lt;/set&amp;gt;
  &amp;lt;/init&amp;gt;
  &amp;lt;label&amp;gt;filter a table in a dashboard from textbox&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false"&amp;gt;
    &amp;lt;input type="text" token="tkn_make" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Make&amp;lt;/label&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="text" token="tkn_model" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Model&amp;lt;/label&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) &amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-24h@h&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
          &amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="count"&amp;gt;100&amp;lt;/option&amp;gt;
        &amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
        &amp;lt;option name="percentagesRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
        &amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Thanks&lt;/P&gt;</description>
      <pubDate>Wed, 22 Nov 2017 17:51:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293175#M55814</guid>
      <dc:creator>kamlesh_vaghela</dc:creator>
      <dc:date>2017-11-22T17:51:34Z</dc:date>
    </item>
    <item>
      <title>Re: filter a table in a dashboard from textbox</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293176#M55815</link>
      <description>&lt;P&gt;This makes complete sense and worked for me. Thanks @kamlesh_vaghela. &lt;/P&gt;</description>
      <pubDate>Wed, 22 Nov 2017 18:03:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293176#M55815</guid>
      <dc:creator>behudelson</dc:creator>
      <dc:date>2017-11-22T18:03:25Z</dc:date>
    </item>
    <item>
      <title>Re: filter a table in a dashboard from textbox</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293177#M55816</link>
      <description>&lt;P&gt;@kamlesh_vaghela, instead of using &lt;CODE&gt;&amp;lt;init&amp;gt;&lt;/CODE&gt; section, I would use submit button so that search runs when user confirms after providing both model and make.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;fieldset submitButton="false"&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I would also add depends to row, so that row is displayed only when both tokens are present. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;row depends="$tkn_make$,$tkn_model$"&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Finally, the search query should filter results as early as possible which would be in the base search i.e. &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;query&amp;gt;
        &amp;lt;YourBaseSearch&amp;gt; Make="$tkn_make$" Model="$tkn_model$" | &amp;lt;YourRemainingSearch&amp;gt;
&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Wed, 22 Nov 2017 18:48:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/filter-a-table-in-a-dashboard-from-textbox/m-p/293177#M55816</guid>
      <dc:creator>niketn</dc:creator>
      <dc:date>2017-11-22T18:48:06Z</dc:date>
    </item>
  </channel>
</rss>

