<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to Use Static Dropdowns in Dashboard in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309248#M19744</link>
    <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;So I have data with Regions and as of now- I have a region called A that needs to be mapped as region AA and AB. Region AA and AB have different countries in them. I want to filter my report on region AA or region AB. I am trying to create a static drop down that includes specific countries in AA or AB. I also have regions C, D, E that can remain the same in the data and use a dynamic filter for those. Is there anyway to do this? I tried creating multiple static options but then AA appeared multiple times in my drop down filter. Thank you for the help!&lt;/P&gt;</description>
    <pubDate>Tue, 29 Aug 2017 20:49:15 GMT</pubDate>
    <dc:creator>katzr</dc:creator>
    <dc:date>2017-08-29T20:49:15Z</dc:date>
    <item>
      <title>How to Use Static Dropdowns in Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309248#M19744</link>
      <description>&lt;P&gt;Hello,&lt;/P&gt;

&lt;P&gt;So I have data with Regions and as of now- I have a region called A that needs to be mapped as region AA and AB. Region AA and AB have different countries in them. I want to filter my report on region AA or region AB. I am trying to create a static drop down that includes specific countries in AA or AB. I also have regions C, D, E that can remain the same in the data and use a dynamic filter for those. Is there anyway to do this? I tried creating multiple static options but then AA appeared multiple times in my drop down filter. Thank you for the help!&lt;/P&gt;</description>
      <pubDate>Tue, 29 Aug 2017 20:49:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309248#M19744</guid>
      <dc:creator>katzr</dc:creator>
      <dc:date>2017-08-29T20:49:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to Use Static Dropdowns in Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309249#M19745</link>
      <description>&lt;P&gt;Can you share your dropdown xml code, your current search (showing how that token is used), current and expected mock output?&lt;/P&gt;</description>
      <pubDate>Tue, 29 Aug 2017 20:54:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309249#M19745</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2017-08-29T20:54:04Z</dc:date>
    </item>
    <item>
      <title>Re: How to Use Static Dropdowns in Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309250#M19746</link>
      <description>&lt;PRE&gt;&lt;CODE&gt; &amp;lt;/input&amp;gt;
&amp;lt;input type="multiselect" token="reg"&amp;gt;
  &amp;lt;label&amp;gt;Region&amp;lt;/label&amp;gt;
  &amp;lt;search&amp;gt;
    &amp;lt;query&amp;gt;index=it_snow_call_kiosk_logs_weekly  | stats count by region&amp;lt;/query&amp;gt;
  &amp;lt;/search&amp;gt;
  &amp;lt;fieldForLabel&amp;gt;region&amp;lt;/fieldForLabel&amp;gt;
  &amp;lt;fieldForValue&amp;gt;region&amp;lt;/fieldForValue&amp;gt;
  &amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
  &amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;
  &amp;lt;valuePrefix&amp;gt;region="&amp;lt;/valuePrefix&amp;gt;
  &amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;
  &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
  &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
  &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;input type="multiselect" token="country"&amp;gt;
  &amp;lt;label&amp;gt;Country&amp;lt;/label&amp;gt;
  &amp;lt;search&amp;gt;
    &amp;lt;query&amp;gt;index=it_snow_call_kiosk_logs_weekly $reg$ | stats count by caller_id_location_country&amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;0&amp;lt;/earliest&amp;gt;
  &amp;lt;/search&amp;gt;
  &amp;lt;fieldForLabel&amp;gt;caller_id_location_country&amp;lt;/fieldForLabel&amp;gt;
  &amp;lt;fieldForValue&amp;gt;caller_id_location_country&amp;lt;/fieldForValue&amp;gt;
  &amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
  &amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;
  &amp;lt;valuePrefix&amp;gt;caller_id_location_country="&amp;lt;/valuePrefix&amp;gt;
  &amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;
  &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
  &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
  &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;input type="multiselect" token="loc"&amp;gt;
  &amp;lt;label&amp;gt;Location&amp;lt;/label&amp;gt;
  &amp;lt;search&amp;gt;
    &amp;lt;query&amp;gt;index=it_snow_call_kiosk_logs_weekly $country$ | stats count by location&amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;0&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;&amp;lt;/latest&amp;gt;
  &amp;lt;/search&amp;gt;
  &amp;lt;fieldForLabel&amp;gt;location&amp;lt;/fieldForLabel&amp;gt;
  &amp;lt;fieldForValue&amp;gt;location&amp;lt;/fieldForValue&amp;gt;
  &amp;lt;prefix&amp;gt;(&amp;lt;/prefix&amp;gt;
  &amp;lt;suffix&amp;gt;)&amp;lt;/suffix&amp;gt;
  &amp;lt;valuePrefix&amp;gt;location="&amp;lt;/valuePrefix&amp;gt;
  &amp;lt;valueSuffix&amp;gt;"&amp;lt;/valueSuffix&amp;gt;
  &amp;lt;delimiter&amp;gt; OR &amp;lt;/delimiter&amp;gt;
  &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
&amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So the region value is the one that has a region i need to split up by country and essentially in my search I want to separate my region A into two different regions so lets say they select region AA and select all for my country and location filters- then I need my search to include all of the countries from region AA - does that make sense? &lt;/P&gt;</description>
      <pubDate>Tue, 29 Aug 2017 21:06:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309250#M19746</guid>
      <dc:creator>katzr</dc:creator>
      <dc:date>2017-08-29T21:06:30Z</dc:date>
    </item>
    <item>
      <title>Re: How to Use Static Dropdowns in Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309251#M19747</link>
      <description>&lt;P&gt;UPDATED TO BE EVEN SIMPLER:&lt;/P&gt;

&lt;P&gt;The simplest way would be to create a lookup table with two columns - &lt;CODE&gt;region&lt;/CODE&gt; and &lt;CODE&gt;caller_id_location_country&lt;/CODE&gt;.&lt;/P&gt;

&lt;P&gt;The countries in Region A would appear in two different regions, Region A and Region AA or AB.&lt;/P&gt;

&lt;P&gt;Populate your dropdown  'reg'  with ...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;query&amp;gt;| inputlookup mycountries.csv | stats count by region&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Populate your dropdown &lt;CODE&gt;country&lt;/CODE&gt; with ... &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;query&amp;gt; | inputlookup mycountries.csv | where $reg$ | stats count by caller_id_location_country&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;HR /&gt;

&lt;P&gt;Or you could hard code them into the current queries...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt; &amp;lt;query&amp;gt;index=it_snow_call_kiosk_logs_weekly  
| stats count by region 
| append [| makeresults 
          | eval region=mvappend ("AA","AB") 
          | mvexpand region 
          | table region
          ] 
| sort 0 region 
 &amp;lt;/query&amp;gt;

 &amp;lt;query&amp;gt;index=it_snow_call_kiosk_logs_weekly $reg$ 
| stats count as mycount by caller_id_location_country
| append [|makeresults 
          | eval regiondata=mvappend("AA,country AA1","AA,CountryAA2","AB,Country AB1", "AB,Country AB2") 
          | makemv regiondata 
          | mvexpand regiondata 
          | rex field=regiondata "(?&amp;lt;region&amp;gt;[^,]+),(?&amp;lt;caller_id_location_country&amp;gt;.*)" 
          | search $reg$ 
          | table caller_id_location_country
          ]
| stats count by caller_id_location_country
&amp;lt;/query&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 29 Aug 2017 22:07:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309251#M19747</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2017-08-29T22:07:56Z</dc:date>
    </item>
    <item>
      <title>Re: How to Use Static Dropdowns in Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309252#M19748</link>
      <description>&lt;P&gt;Change location query to this.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=it_snow_call_kiosk_logs_weekly $reg$  $country$ | stats count by location
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Since there are overlapping in countries, we need to use both prior filters.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Aug 2017 01:53:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-Use-Static-Dropdowns-in-Dashboard/m-p/309252#M19748</guid>
      <dc:creator>somesoni2</dc:creator>
      <dc:date>2017-08-30T01:53:20Z</dc:date>
    </item>
  </channel>
</rss>

