<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: filter based on dropdown with condition in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469442#M30824</link>
    <description>&lt;P&gt;If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection.&lt;/P&gt;

&lt;P&gt;Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;3 env demo&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false" autoRun="false"&amp;gt;
    &amp;lt;input type="dropdown" token="tokEnv"&amp;gt;
      &amp;lt;label&amp;gt;Environment&amp;lt;/label&amp;gt;
      &amp;lt;choice value="dev"&amp;gt;dev&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="tst"&amp;gt;tst&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="prd"&amp;gt;prd&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;dev&amp;lt;/default&amp;gt;
      &amp;lt;initialValue&amp;gt;dev&amp;lt;/initialValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;condition label="dev"&amp;gt;
          &amp;lt;set token="dev"&amp;gt;true&amp;lt;/set&amp;gt;
          &amp;lt;unset token="tst"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;unset token="prd"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;/condition&amp;gt;
        &amp;lt;condition label="tst"&amp;gt;
          &amp;lt;unset token="dev"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;set token="tst"&amp;gt;true&amp;lt;/set&amp;gt;
          &amp;lt;unset token="prd"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;/condition&amp;gt;
        &amp;lt;condition label="prd"&amp;gt;
          &amp;lt;unset token="dev"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;unset token="tst"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;set token="prd"&amp;gt;true&amp;lt;/set&amp;gt;
        &amp;lt;/condition&amp;gt;
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel depends="$dev$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;dev panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-10s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel depends="$tst$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;tst panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-1s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel depends="$prd$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;prd panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-1s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Mon, 01 Jun 2020 17:43:01 GMT</pubDate>
    <dc:creator>jpolvino</dc:creator>
    <dc:date>2020-06-01T17:43:01Z</dc:date>
    <item>
      <title>filter based on dropdown with condition</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469441#M30823</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;

&lt;P&gt;Could someone help on the below requirement.&lt;/P&gt;

&lt;P&gt;I have the index as sampleindex and which returns the one of the output called environment_name as &lt;BR /&gt;
app1_dev,&lt;BR /&gt;
 app1_tst, &lt;BR /&gt;
app1_prd,&lt;BR /&gt;
 app2_dev, &lt;BR /&gt;
app2_tst, &lt;BR /&gt;
app2_prd, &lt;BR /&gt;
app2,dev, &lt;BR /&gt;
app3_tst,&lt;BR /&gt;
app3_prd. &lt;BR /&gt;
along with few more outputs,  i have to bring the timechart with environment_name and cost on given duration.&lt;/P&gt;

&lt;P&gt;Here I am not interested on all environment, for example i need to get the result only on app1_dev, app2_dev and we don't want to show app3_dev when i am selecting the Environment name as "dev". Same applies for all environment. &lt;/P&gt;

&lt;P&gt;And the above given environment combination is just an sample, i have around 10+ environment(dev, int, tst, prd, etc...) with combination of 10 application (app1, app2, app3, etc..,)&lt;/P&gt;

&lt;P&gt;I have to use Dropdown as Input field and choice as , to group all the environment type as below.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    &amp;lt;label&amp;gt;Environment&amp;lt;/label&amp;gt;
    &amp;lt;choice value="*dev"&amp;gt;dev&amp;lt;/choice&amp;gt;
    &amp;lt;choice value="*tst"&amp;gt;tst&amp;lt;/choice&amp;gt;
    &amp;lt;choice value="*prd"&amp;gt;prd&amp;lt;/choice&amp;gt;
    &amp;lt;default&amp;gt;*prd&amp;lt;/default&amp;gt;
  &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;When i select the value as "dev", the chart should show the output as app1_dev, app2_dev and app2_dev on chart . Could someone help on how to query this. I have tried using case statement, but which returns as sum based on environment namings what i selecting from dropdown..&lt;/P&gt;

&lt;P&gt;eval namespace=case(match(environment_name,"app1-dev"),"dev", match(environment_name,"app2-dev"),"dev", match(environment_name,"app3-dev"),"dev")&lt;/P&gt;

&lt;P&gt;Re phrased the question again.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 05:36:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469441#M30823</guid>
      <dc:creator>prakashmca05</dc:creator>
      <dc:date>2020-09-30T05:36:11Z</dc:date>
    </item>
    <item>
      <title>Re: filter based on dropdown with condition</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469442#M30824</link>
      <description>&lt;P&gt;If your searches are lightweight, you could potentially run all 3 searches and hide/show panels depending on the dropdown value selected. This works well if you have static index and environment_names, which looks to be true in your case. It also renders very fast when you switch the drop down selection.&lt;/P&gt;

&lt;P&gt;Here is one way to do it, which can be pasted in as dashboard source XML. It has dummy searches to illustrate different results.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;3 env demo&amp;lt;/label&amp;gt;
  &amp;lt;fieldset submitButton="false" autoRun="false"&amp;gt;
    &amp;lt;input type="dropdown" token="tokEnv"&amp;gt;
      &amp;lt;label&amp;gt;Environment&amp;lt;/label&amp;gt;
      &amp;lt;choice value="dev"&amp;gt;dev&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="tst"&amp;gt;tst&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="prd"&amp;gt;prd&amp;lt;/choice&amp;gt;
      &amp;lt;default&amp;gt;dev&amp;lt;/default&amp;gt;
      &amp;lt;initialValue&amp;gt;dev&amp;lt;/initialValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;condition label="dev"&amp;gt;
          &amp;lt;set token="dev"&amp;gt;true&amp;lt;/set&amp;gt;
          &amp;lt;unset token="tst"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;unset token="prd"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;/condition&amp;gt;
        &amp;lt;condition label="tst"&amp;gt;
          &amp;lt;unset token="dev"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;set token="tst"&amp;gt;true&amp;lt;/set&amp;gt;
          &amp;lt;unset token="prd"&amp;gt;&amp;lt;/unset&amp;gt;
        &amp;lt;/condition&amp;gt;
        &amp;lt;condition label="prd"&amp;gt;
          &amp;lt;unset token="dev"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;unset token="tst"&amp;gt;&amp;lt;/unset&amp;gt;
          &amp;lt;set token="prd"&amp;gt;true&amp;lt;/set&amp;gt;
        &amp;lt;/condition&amp;gt;
      &amp;lt;/change&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
    &amp;lt;panel depends="$dev$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;dev panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults count=5 | eval x=1 | accum x | autoregress x p=1-4&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-10s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel depends="$tst$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;tst panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults | eval timestamp=strftime(_time,"%Y-%m-%d %H:%M:%S")&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-1s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
    &amp;lt;panel depends="$prd$"&amp;gt;
      &amp;lt;table&amp;gt;
        &amp;lt;title&amp;gt;prd panel&amp;lt;/title&amp;gt;
        &amp;lt;search&amp;gt;
          &amp;lt;query&amp;gt;| makeresults count=3 | eval x=5 | accum x | autoregress x p=1-2&amp;lt;/query&amp;gt;
          &amp;lt;earliest&amp;gt;-1s@s&amp;lt;/earliest&amp;gt;
          &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
        &amp;lt;/search&amp;gt;
        &amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
      &amp;lt;/table&amp;gt;
    &amp;lt;/panel&amp;gt;
  &amp;lt;/row&amp;gt;
&amp;lt;/form&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 01 Jun 2020 17:43:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469442#M30824</guid>
      <dc:creator>jpolvino</dc:creator>
      <dc:date>2020-06-01T17:43:01Z</dc:date>
    </item>
    <item>
      <title>Re: filter based on dropdown with condition</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469443#M30825</link>
      <description>&lt;P&gt;Thanks for your Input.&lt;/P&gt;

&lt;P&gt;In the example, i have provided just 3 environment name for example. Actually i have around 10+ of environments. Do we have any alternative way rather using the panel for each environment ?&lt;/P&gt;

&lt;P&gt;However i will be trying this solution as well to see how this works.&lt;/P&gt;</description>
      <pubDate>Tue, 02 Jun 2020 11:50:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469443#M30825</guid>
      <dc:creator>prakashmca05</dc:creator>
      <dc:date>2020-06-02T11:50:21Z</dc:date>
    </item>
    <item>
      <title>Re: filter based on dropdown with condition</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469444#M30826</link>
      <description>&lt;P&gt;I have updated the question again with clear requirement.&lt;/P&gt;</description>
      <pubDate>Tue, 02 Jun 2020 12:46:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/filter-based-on-dropdown-with-condition/m-p/469444#M30826</guid>
      <dc:creator>prakashmca05</dc:creator>
      <dc:date>2020-06-02T12:46:05Z</dc:date>
    </item>
  </channel>
</rss>

