topic Re: Cascading Dynamic dropdowns in Dashboards & Visualizations

Cascading Dynamic dropdowns

crispb — Wed, 26 May 2021 00:00:05 GMT

Hello,

I am attempting to create a search that utilises two drop boxes.

The first dropdown is populated from a query which lists servers

<label>Server List</label> <description>Projects the future disk usage of all/description> <fieldset autoRun="false" submitButton="true"> <input type="dropdown" token="Host" searchWhenChanged="true"> <label>Server Name</label> <fieldForLabel>Host</fieldForLabel> <fieldForValue>Host</fieldForValue> <search> <query>| inputlookup windows_hostmon_system | regex Host="regexgoeshere" | dedup Host</query> </search> <default>default server goes here</default> <initialValue>InitialServerName</initialValue> </input>

I then want to use the selection of the above dropdown and commit it to a token to be used in the next dropdown.

<input type="dropdown" token="Disk"> <label>Disk</label> <fieldForLabel>Disk</fieldForLabel> <fieldForValue>Name</fieldForValue> <search> <query>eventtype=hostmon_windows source=Disk host="$HostChoice$" sourcetype="Winhostmon" Name="*" | stats count(Name) by Name</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input>

Is it possible to capture the output of a dynamic dropdown and use that output as a variable in other dynamic dropdowns.

Kind Regards

Re: Cascading Dynamic dropdowns

gcusello — Wed, 26 May 2021 06:43:42 GMT

Hi @crispb,

yes you can:

the second dropdown is a search as the ones in panels, so you have to put the token in the input's search as if they were:

eventtype=hostmon_windows source=Disk host="$Host$" sourcetype="Winhostmon" Name="*" | stats count by Name

Ciao.

Giuseppe

Re: Cascading Dynamic dropdowns

crispb — Wed, 26 May 2021 21:46:26 GMT

Hello @gcusello

Thanks for the response.

I honestly must of missed that I renamed the token.

Many hours of frustration fixed by a fresh set of eyes.

Thanks for the help.

Regards

Re: Cascading Dynamic dropdowns

gcusello — Thu, 27 May 2021 05:39:49 GMT

Hi @crispb,

no problem: it's an easy error 😉

The important thing is that you solved, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉