topic Re: search result as field for filtering in visualization in Dashboards & Visualizations

search result as field for filtering in visualization

totaro — Thu, 25 Apr 2019 08:03:40 GMT

Hi
i have a statistic table in one of my dashboard that show the result of a search. Is it possible to use some of those fields as filter without re-running the search?

e.g.
Table:

Date Field     Field1
04/22              A
04/18              B
04/11              C

As the date field is dynamic and is the result of the search, is it possible to use those as a field as dashboard input to show Field1 only from a specific date.

Re: search result as field for filtering in visualization

gcusello — Thu, 25 Apr 2019 08:19:57 GMT

Hi totaro,
let me understand. do you want to display Field1 values with Date fiels greather than the clicked value clicking e.g. on 04/18 and without re run the search?
You could do this passing the clicked field value as a token to another search to run in a different panel of the same dashboard or to another dashboard, in this way you have to re-run the same search but limited by the clicked value.
You can find how to pass a token to another panel of the same dashboard in the Dashboard Examples App (see https://splunkbase.splunk.com/app/1603/).

Bye.
Giuseppe

Re: search result as field for filtering in visualization

vnravikumar — Fri, 26 Apr 2019 07:01:43 GMT

Check this sample and use base search

<form>
  <label>filter</label>
  <search id="base_query">
    <query>index="_internal"  |table source,host,sourcetype,splunk_server</query>
    <earliest>$timepicker.earliest$</earliest>
    <latest>$timepicker.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="timepicker">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="host">
      <label>host</label>
      <search base="base_query">
        <query>|stats count by host</query>
      </search>
      <fieldForLabel>host</fieldForLabel>
      <fieldForValue>host</fieldForValue>
      <prefix>host="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base_query">
          <query>
           |search $host$ |stats count by source
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>