topic Re: How to apply drop down to all the panels in dashboard? in Dashboards & Visualizations

How to apply drop down to all the panels in dashboard?

purushothama — Wed, 30 Sep 2020 01:13:19 GMT

Hi,
I am new to Splunk creating my first dashboard.

I have created a drop-down using CSV file as lookup included the column partner_id and partner_name. In my drop down I have included all the partner names but I am not getting how to apply that drop down to all the panels in the dashboard.
Please someone can help me to overcome this?

Re: How to apply drop down to all the panels in dashboard?

vnravikumar — Thu, 11 Jul 2019 17:08:17 GMT

Try like

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="partner">
      <label>Partner</label>
      <fieldForLabel>partner_id</fieldForLabel>
      <fieldForValue>partner_name</fieldForValue>
      <search>
        <query>|inputlookup partner.csv |table partner_id,  partner_name</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <prefix>partner_id="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="main" $partner$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Token $partner$ will substitute likepartner_id="p1"

Re: How to apply drop down to all the panels in dashboard?

purushothama — Fri, 12 Jul 2019 05:53:52 GMT

Hi,

Thank you for your answer,

I have tried what you have to suggested but it s not working. i will share the xml file below please can you help me to change in drop down query. from below source. i am getting all the partner_names in the dropdown list, but i am facing the problem how to apply this drop down to all the panel?

Telemetry by partner_P1

</input>
<input type="dropdown" token="partner_name" searchWhenChanged="true">
  <label>partner</label>
  <fieldForLabel>partner</fieldForLabel>
  <fieldForValue>partner_name</fieldForValue>
  <search>
    <query>index=genesis sourcetype=genesis_body_header_txt AuditEvent_ApplicationId=WebserviceGateway  | lookup Wholesale_Partner_Lookup.csv partner_id as AuditKeys_PARTNERID output partner_name | stats count by partner_name</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </search>
</input>
  <panel>
  <title>Top Errors by Error Code</title>
  <chart>
    <search>
      <query>index=genesis sourcetype=genesis_body_header_txt AuditEvent_Event=GENESIS_TRANSACTION AuditKeys_STATUS=COMPLETE AuditKeys_RESULTS=FAILURE  AuditKeys_ERRORCODE=GENS-0004 OR GENS-0005 OR GENS-0054 OR GENS-0067 OR GENS-0068 OR GENS-0103 OR GENS-0150 OR GENS-0292 OR GENS-0293 OR GENS-0294 OR GENS-0295 OR GENS-0296 OR GENS-0298 OR GENS-0299 OR GENS-0304 OR GENS-0403 AuditKeys_PARTNERID=* | timechart count(AuditKeys_ERRORCODE) as ERRORCODE by AuditKeys_ERRORCODE</query>
      <earliest>$Time Picker.earliest$</earliest>
      <latest>$Time Picker.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
    <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
    <option name="charting.axisTitleX.visibility">visible</option>
    <option name="charting.axisTitleY.visibility">visible</option>
    <option name="charting.axisTitleY2.visibility">visible</option>
    <option name="charting.axisX.abbreviation">none</option>
    <option name="charting.axisX.scale">linear</option>
    <option name="charting.axisY.abbreviation">none</option>
    <option name="charting.axisY.scale">linear</option>
    <option name="charting.axisY2.abbreviation">none</option>
    <option name="charting.axisY2.enabled">0</option>
    <option name="charting.axisY2.scale">inherit</option>
    <option name="charting.chart">line</option>
    <option name="charting.chart.bubbleMaximumSize">50</option>
    <option name="charting.chart.bubbleMinimumSize">10</option>
    <option name="charting.chart.bubbleSizeBy">area</option>
    <option name="charting.chart.nullValueMode">zero</option>
    <option name="charting.chart.showDataLabels">none</option>
    <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
    <option name="charting.chart.stackMode">default</option>
    <option name="charting.chart.style">shiny</option>
    <option name="charting.drilldown">none</option>
    <option name="charting.layout.splitSeries">0</option>
    <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
    <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
    <option name="charting.legend.mode">standard</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.lineWidth">2</option>
    <option name="refresh.display">progressbar</option>
    <option name="trellis.enabled">0</option>
    <option name="trellis.scales.shared">1</option>
    <option name="trellis.size">medium</option>
  </chart>

Re: How to apply drop down to all the panels in dashboard?

vnravikumar — Fri, 12 Jul 2019 05:59:07 GMT

If I'm not wrong you are trying to filter the result based on partner chosen in the dropdown. If that is the case what is the field name in the index.

Re: How to apply drop down to all the panels in dashboard?

purushothama — Fri, 12 Jul 2019 13:20:30 GMT

The field name in index is "AuditKeys_PARTNERID" i have declared that as "partner"

Re: How to apply drop down to all the panels in dashboard?

purushothama — Wed, 30 Sep 2020 01:18:18 GMT

Based on "AuditKeys_PARTNERID" i have lookup the CSV file to get the partner_name. now i am able to show the partner name in the drop down, but i am not to apply those drop down to all the panel in the dashboard.

Re: How to apply drop down to all the panels in dashboard?

vnravikumar — Wed, 30 Sep 2020 01:18:21 GMT

change in prefix with

   <label>Partner</label>
   <fieldForLabel>partner_id</fieldForLabel>
   <fieldForValue>partner_name</fieldForValue>
   <search>
     <query>|inputlookup partner.csv |table partner_id,  partner_name</query>
     <earliest>-24h@h</earliest>
     <latest>now</latest>
   </search>
   <prefix>AuditKeys_PARTNERID="</prefix>
   <suffix>"</suffix>
 </input>

and in query

index=genesis sourcetype=genesis_body_header_txt AuditEvent_Event=GENESIS_TRANSACTION AuditKeys_STATUS=COMPLETE AuditKeys_RESULTS=FAILURE AuditKeys_ERRORCODE=GENS-0004 OR GENS-0005 OR GENS-0054 OR GENS-0067 OR GENS-0068 OR GENS-0103 OR GENS-0150 OR GENS-0292 OR GENS-0293 OR GENS-0294 OR GENS-0295 OR GENS-0296 OR GENS-0298 OR GENS-0299 OR GENS-0304 OR GENS-0403 $partner$ | timechart count(AuditKeys_ERRORCODE) as ERRORCODE by AuditKeys_ERRORCODE

Re: How to apply drop down to all the panels in dashboard?

purushothama — Wed, 30 Sep 2020 01:19:09 GMT

Hi ravi ,

Thank you for your help,

it is not working as you suggested. i dont know where i am going wrong. Please check the query i have applied in drop down below and let me know if any changes i need to make to get the result. i have used in dropdowm token = partner_name, label=partner, value=partner_name. Please can help me to overcome this issue?

index=genesis sourcetype=genesis_body_header_txt AuditEvent_ApplicationId=WebserviceGateway | lookup Wholesale_Partner_Lookup_Updated.csv partner_id as AuditKeys_PARTNERID output partner_name | stats count by partner_name

Re: How to apply drop down to all the panels in dashboard?

purushothama — Wed, 17 Jul 2019 06:21:35 GMT

hi ravi,

As your previous suggestion "$partner$" in all the panel query it is working fine. Thank you.