topic Re: Is it possible to have multiple populating searches in a single drop down menu? in Dashboards & Visualizations

Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Tue, 20 Feb 2018 00:45:49 GMT

Is it possible to have multiple populating searches in a single drop down menu?

  <label>Select a CITY</label>
  <default>*</default>
  <choice value="*">All Cities</choice>
  <fieldForLabel>CityName</fieldForLabel>
  <fieldForValue>CITY</fieldForValue>
  <search base="lookup_csv">
    <query>search OPEN="Y" AND EXIST ="Y" | search TimeZone=$TimeZone$ AND Territory=$Territory$ AND Region=$Region$ AND District=$District$ AND STATE=$State$  
    | sort CITY
    | eval CityName = CITY+"-"+CITY_NAME+"-"+STATE 
    | table CITY CityName</query>
  </search>
</input>

The base search gets me the City names from a lookup file. What i need now is to another option in the same drop down menu named as "Special Cities" which will populate the values from a different lookup file which i can define here. And when that option is selected by the user, the subsequent searches should use those values to search for the events.

Is it possible?

Re: Is it possible to have multiple populating searches in a single drop down menu?

niketn — Tue, 20 Feb 2018 02:50:49 GMT

@macadminrohit, You can use append to add the results from second search to your current search. Make sure fields returned are same i.e. CITY, CITY_NAME and STATE.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append#Examples
Without the actual fields in the second lookup special cities and lookup/lookup file name it will be tough assist you with exact query.

Also, your current search shows filter in base search as well as after first pipe. Make sure all your filters are in your base search if possible.

Re: Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Tue, 20 Feb 2018 03:45:23 GMT

Thanks Niket, There will be only one field name in the second lookup ( special cities) , which is just numbers
001, 002, 003 etc and the lookup name will be special_cities.csv

Re: Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Tue, 20 Feb 2018 03:47:46 GMT

And there are other searches in this dashboard which are using this base search so i cant really modify it.

Re: Is it possible to have multiple populating searches in a single drop down menu?

niketn — Tue, 20 Feb 2018 04:03:04 GMT

Ok so let me clarify the intent. Do you want to have static option "Special Cities" in Dropdown and when that is selected pass the special city codes from lookup to search? Is this correct?

What is the search you want to run is there a field corresponding to Special City codes in your indexed data?

I saw that you are using a base search to populate results in the dropdown but does not seem like this search is used for recursive post processing so it can be modified. However, based on answer to my previous question change to search might not be required.

Re: Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Tue, 20 Feb 2018 15:50:31 GMT

Yes the Special cities field values will be coming from another lookup which has just the list of special cities. So once that option is selected, we need all events related to those special cities field values.

Drop down will look something like this :

Select a City:
ALL CITIES
Special Cities
City1
City2
City3

So when the user selects ALL CITIES, by default a * is used as a field value in other searches. When Special Cities is selected, it should recursively take all values from the lookup and use in other searches.

Re: Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Thu, 22 Feb 2018 20:09:35 GMT

We were able to do this, by adding some logic to the dashboard.

Re: Is it possible to have multiple populating searches in a single drop down menu?

niketn — Sat, 24 Feb 2018 05:33:18 GMT

@macadminrohit, good to know that you were able to resolve this. I would request you to add the approach taken to resolve the issue and Accept the same to mark this question as answered!

Re: Is it possible to have multiple populating searches in a single drop down menu?

macadminrohit — Tue, 27 Feb 2018 19:26:46 GMT

  <label>Select SPACE:</label>
  <default>WHOLE</default>
  <choice value="*">All SPACE</choice>
  <choice value="tech">TECH </choice>
  <fieldForLabel>spaceName</fieldForLabel>
  <fieldForValue>SPACE</fieldForValue>
  <search>
    <query> main search        | table SPACE spaceName</query>
  </search>
  <change>
    <condition value="WHOLE">
      <set token="TC_SPACE_FLAG">Y</set>
    </condition>
    <condition>
      <unset token="TC_SPACE_FLAG"></unset>
    </condition>
  </change>
  <suffix>*</suffix>
</input>
<input type="dropdown" token="MORE_SPACE" searchWhenChanged="true" depends="$HideIt$">
  <label>MORE_SPACE</label>
  <fieldForLabel>TS</fieldForLabel>
  <fieldForValue>TS</fieldForValue>
  <selectFirstChoice>true</selectFirstChoice>
  <search>
    <query> main query to get TS</query>
    <done>
      <set token="Space">$result.TS$</set>
    </done>
  </search>

So basically we are creating another drop down which we are hiding. So as soon as the corresponding drop down item is selected, all the items in the hidden drop down are invoked.

Re: Is it possible to have multiple populating searches in a single drop down menu?

niketn — Tue, 27 Feb 2018 20:01:54 GMT

@macadminrohit, I have converted your comment to Answer. Please accept the same to mark this as answered.