Dropdown filter in Splunk dashboard studio

saichandjawari — Fri, 14 Mar 2025 12:10:52 GMT

I have below combo for region/environment

	Cluster	Space	Region
1	useast01	abs-qpp1	QAEAST
2	uswest01	abs-qpp1	QAWEST
3	usqaf01	abs-qff	QAF

1) If Cluster is useast01 and space is abs-qpp1 then the region is USEAST
2) If the cluster is uswest01 and space is abs-qpp1 then the region is USWEST
3) If the cluster is usqaf01 and space is abs-qff then the region is USQAF

I would like to have a single dropdown filter for Region (USEAST, USWEST, USQAF) with dynamic label select option for the above combos.

Request if someone provides a solution or an approach o

Re: Dropdown filter in Splunk dashboard studio

livehybrid — Fri, 14 Mar 2025 14:30:30 GMT

Hi @saichandjawari

Have a look at the example below, I have included the dashboard config further down.

I am using the original cluster dropdown value with a query (called myvar) displayed as a table (hidden out of view) and then using $myvar:result.<field>$ where we need to use the value.

livehybrid_0-1741962556997.png

{ "title": "Answers - testing", "description": "", "inputs": { "input_mwKjgBTB": { "options": { "items": [ { "label": "useast01", "value": "useast01" }, { "label": "uswest01", "value": "uswest01" }, { "label": "usqaf01", "value": "usqaf01" } ], "selectFirstSearchResult": true, "token": "cluster" }, "title": "Cluster", "type": "input.dropdown" } }, "defaults": { "dataSources": { "ds.search": { "options": { "queryParameters": { "earliest": "$global_time.earliest$", "latest": "$global_time.latest$" } } } } }, "visualizations": { "viz_2uQp06o5": { "dataSources": { "primary": "ds_c8AfQapt" }, "type": "splunk.table" }, "viz_JQgp3c9c": { "containerOptions": {}, "dataSources": { "primary": "ds_eGOCKAoM_ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Cluster", "type": "splunk.singlevalue" }, "viz_bxuHwYLl": { "containerOptions": {}, "dataSources": { "primary": "ds_FKvGrvZ4_ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Space", "type": "splunk.singlevalue" }, "viz_column_chart": { "containerOptions": {}, "dataSources": { "primary": "ds_qBGlESX2" }, "eventHandlers": [ { "options": { "tokens": [ { "key": "name", "token": "method" } ] }, "type": "drilldown.setToken" } ], "options": { "majorValue": "> sparklineValues | lastPoint()", "trendValue": "> sparklineValues | delta(-2)" }, "showLastUpdated": false, "showProgressBar": false, "title": "Region", "type": "splunk.singlevalue" } }, "dataSources": { "ds_FKvGrvZ4_ds_qBGlESX2": { "name": "get_space", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval space=\"$myvars:result.space$\"" }, "type": "ds.search" }, "ds_c8AfQapt": { "name": "myvars", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval cluster=\"$cluster$\"\n| eval space=CASE(cluster==\"usqaf01\", \"abs-qff\", cluster==\"uswest01\",\"abs-qpp1\",cluster==\"useast01\",\"abs-qpp1\")\n| eval region=CASE(cluster==\"usqaf01\", \"QAF\", cluster==\"uswest01\",\"QAWEST\",cluster==\"useast01\",\"QAEAST\")", "queryParameters": { "earliest": "-24h@h", "latest": "now" } }, "type": "ds.search" }, "ds_eGOCKAoM_ds_qBGlESX2": { "name": "get_cluster", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval cluster=\"$myvars:result.cluster$\"" }, "type": "ds.search" }, "ds_qBGlESX2": { "name": "Search_1", "options": { "enableSmartSources": true, "query": "| makeresults\n| eval region=\"$myvars:result.region$\"" }, "type": "ds.search" } }, "layout": { "globalInputs": [ "input_mwKjgBTB" ], "layoutDefinitions": { "layout_1": { "options": { "display": "auto", "height": 960, "width": 1440 }, "structure": [ { "item": "viz_column_chart", "position": { "h": 250, "w": 350, "x": 370, "y": 0 }, "type": "block" }, { "item": "viz_2uQp06o5", "position": { "h": 100, "w": 580, "x": 1480, "y": 70 }, "type": "block" }, { "item": "viz_JQgp3c9c", "position": { "h": 250, "w": 350, "x": 0, "y": 0 }, "type": "block" }, { "item": "viz_bxuHwYLl", "position": { "h": 250, "w": 350, "x": 740, "y": 0 }, "type": "block" } ], "type": "absolute" } }, "tabs": { "items": [ { "label": "New tab", "layoutId": "layout_1" } ] } } }

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

topic Re: Dropdown filter in Splunk dashboard studio in Dashboards & Visualizations

Dropdown filter in Splunk dashboard studio

Re: Dropdown filter in Splunk dashboard studio