<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Drop Down - Dashboard in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692489#M56743</link>
    <description>&lt;P&gt;Hi &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt; , yes your correct. Now I corrected it it's working as expected.&lt;/P&gt;&lt;P&gt;Thank you &lt;span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:"&gt;😊&lt;/span&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 05 Jul 2024 14:22:46 GMT</pubDate>
    <dc:creator>Ram2</dc:creator>
    <dc:date>2024-07-05T14:22:46Z</dc:date>
    <item>
      <title>Drop Down - Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692444#M56738</link>
      <description>&lt;P&gt;Hi All,&amp;nbsp; Created a drop down for index but when i added the token value in the panel query not working as expected when i select ALL option from the drop down.&lt;BR /&gt;But when i select DEV_INDEX or SIT_INDEX its working fine.&lt;BR /&gt;How to tweak the code to show up 2 indexes&amp;nbsp; data in the panel query when we select ALL option from the drop down???&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;form version="1.1" theme="light"&amp;gt;
&amp;lt;label&amp;gt;Dashboard&amp;lt;/label&amp;gt;
&amp;lt;fieldset submitButton="false"&amp;gt;
&amp;lt;input type="time" token="timepicker"&amp;gt;
&amp;lt;label&amp;gt;TimeRange&amp;lt;/label&amp;gt;
&amp;lt;default&amp;gt;
&amp;lt;earliest&amp;gt;-60m@m&amp;lt;/earliest&amp;gt;
&amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
&amp;lt;/default&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;input type="dropdown" token="Index" searchWhenChanged="true"&amp;gt;
&amp;lt;label&amp;gt;Indexes&amp;lt;/label&amp;gt;
&amp;lt;choice value="dev_index, sit_index"&amp;gt;All&amp;lt;/choice&amp;gt;
&amp;lt;choice value="dev_index"&amp;gt;DEV_INDEX&amp;lt;/choice&amp;gt;
&amp;lt;choice value="sit_index"&amp;gt;SIT_INDEX&amp;lt;/choice&amp;gt;
&amp;lt;/input&amp;gt;
&amp;lt;/fieldset&amp;gt;
&amp;lt;row&amp;gt;
&amp;lt;panel&amp;gt;
&amp;lt;table&amp;gt;
&amp;lt;title&amp;gt;Total Count&amp;lt;/title&amp;gt;
&amp;lt;search&amp;gt;
&amp;lt;query&amp;gt;index IN ("$index$") source=application.logs |stats count by codes&amp;lt;/query&amp;gt;
&amp;lt;earliest&amp;gt;timepicker.earliest&amp;lt;/earliest&amp;gt;
&amp;lt;latest&amp;gt;timepicker.latest&amp;lt;/latest&amp;gt;
&amp;lt;sampleRatio&amp;gt;1&amp;lt;/sampleRatio&amp;gt;
&amp;lt;/search&amp;gt;
&amp;lt;option name="count"&amp;gt;20&amp;lt;/option&amp;gt;
&amp;lt;option name="dataOverlayMode"&amp;gt;none&amp;lt;/option&amp;gt;
&amp;lt;option name="drilldown"&amp;gt;none&amp;lt;/option&amp;gt;
&amp;lt;option name="percentageRow"&amp;gt;false&amp;lt;/option&amp;gt;
&amp;lt;option name="refresh.display"&amp;gt;progressbar&amp;lt;/option&amp;gt;
&amp;lt;option name="rowNumbers"&amp;gt;false&amp;lt;/option&amp;gt;
&amp;lt;option name="totalsRow"&amp;gt;false&amp;lt;/option&amp;gt;
&amp;lt;option name="wrap"&amp;gt;true&amp;lt;/option&amp;gt;
&amp;lt;/table&amp;gt;
&amp;lt;/panel&amp;gt;
&amp;lt;/row&amp;gt;
&amp;lt;form&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 04 Jul 2024 21:56:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692444#M56738</guid>
      <dc:creator>Ram2</dc:creator>
      <dc:date>2024-07-04T21:56:04Z</dc:date>
    </item>
    <item>
      <title>Re: Drop Down - Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692446#M56739</link>
      <description>&lt;P&gt;When your token is expanded in your search, it becomes&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index IN ("dev_index, sit_index")...&lt;/LI-CODE&gt;&lt;P&gt;so that is actually a SINGLE value, which will never match.&lt;/P&gt;&lt;P&gt;There are several ways, but the simplest for you is to just remove the quotes around your search definition, so&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index IN ($index$)...&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 04 Jul 2024 23:10:50 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692446#M56739</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2024-07-04T23:10:50Z</dc:date>
    </item>
    <item>
      <title>Re: Drop Down - Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692447#M56740</link>
      <description>&lt;P&gt;I tried to use&amp;nbsp; as shown below:&lt;/P&gt;&lt;PRE&gt;index IN ($index$)...&lt;/PRE&gt;&lt;P&gt;&amp;nbsp; but my token expanded in search its taking up as&amp;nbsp; index IN (*), which is not working, can u suggest other solution.&lt;/P&gt;</description>
      <pubDate>Thu, 04 Jul 2024 23:37:30 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692447#M56740</guid>
      <dc:creator>Ram2</dc:creator>
      <dc:date>2024-07-04T23:37:30Z</dc:date>
    </item>
    <item>
      <title>Re: Drop Down - Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692450#M56741</link>
      <description>&lt;P&gt;Not sure how your token can be * as there is nothing defined like that, but you DO have a mismatch between your defined token in the input and it's use&lt;/P&gt;&lt;PRE&gt;&amp;lt;input type="dropdown" token="Index" searchWhenChanged="true"&amp;gt;&lt;/PRE&gt;&lt;P&gt;where it's upper case Index and you are using it as lower case $index$&lt;/P&gt;</description>
      <pubDate>Fri, 05 Jul 2024 01:46:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692450#M56741</guid>
      <dc:creator>bowesmana</dc:creator>
      <dc:date>2024-07-05T01:46:44Z</dc:date>
    </item>
    <item>
      <title>Re: Drop Down - Dashboard</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692489#M56743</link>
      <description>&lt;P&gt;Hi &lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/6367"&gt;@bowesmana&lt;/a&gt; , yes your correct. Now I corrected it it's working as expected.&lt;/P&gt;&lt;P&gt;Thank you &lt;span class="lia-unicode-emoji" title=":smiling_face_with_smiling_eyes:"&gt;😊&lt;/span&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 05 Jul 2024 14:22:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-Down-Dashboard/m-p/692489#M56743</guid>
      <dc:creator>Ram2</dc:creator>
      <dc:date>2024-07-05T14:22:46Z</dc:date>
    </item>
  </channel>
</rss>

