topic Re: Autosuggest in Dashboards & Visualizations

Autosuggest

TylerJVitale — Wed, 18 Jul 2018 13:11:59 GMT

I'm creating a dashboard with text inputs. Is there a way to get Splunk to have a dropdown with autosuggestions when the user types in the text box, similar to how it works in the Search and Reporting app?

Re: Autosuggest

renjith_nair — Wed, 18 Jul 2018 16:34:49 GMT

@TylerJVitale,

You could use Multiselect input for that where you could load all your possible dataset and when user start typing, the results are popped up. In text box, there are no ways to pre-populate except the default data.

Re: Autosuggest

TylerJVitale — Wed, 18 Jul 2018 17:03:17 GMT

That seems like it would work. How would I set it up so I could load the dataset i.e. in the input settings what would I have to select/adjust?

Re: Autosuggest

renjith_nair — Thu, 19 Jul 2018 02:04:31 GMT

Please see a sample dashboard which could be run anywhere

<form>
  <label>Tyler J Vitale</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Sourcetype</label>
      <valuePrefix>sourcetype="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_*|stats count by sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_* $sourcetype$ |timechart count by sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">zero</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
      </chart>
    </panel>
  </row>
</form>

Re: Autosuggest

TylerJVitale — Thu, 19 Jul 2018 12:50:10 GMT

The dashboard keeps freezing every time I try to implement this

Re: Autosuggest

renjith_nair — Thu, 19 Jul 2018 14:12:54 GMT

Its quite strange, because we are selecting only last 15 mins data. This is a smoothly running dashboard on my mobile device. You need to select a sourcetype in the multiselect to run the dashboard. What about other searches in your environment?

Re: Autosuggest

TylerJVitale — Thu, 19 Jul 2018 14:17:47 GMT

Other searches in my environment run fine. I think it freezes because there are millions of servers in the database and splunk has difficulty processing all of them into one multiselect input