How do you connected static drop-down to table

fabiyogo1 — Thu, 27 Mar 2025 03:47:27 GMT

I have a problem with the splunk classic dashboard that I have created,
where the problem is that the table dashboard that I have created is not connected properly to the dropdown that I have created, as an example I provide the source of the dashboard that I have created as follows:

<input type="dropdown" token="code_cihub">
<label>Code Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>code_cihub</fieldForLabel>
<fieldForValue>code_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Code Transaction CI HUB"
| rename "Code Transaction CI HUB" as code_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="info">
<label>Info Transaction CI HUB</label>
<choice value="*">All</choice>
<choice value="O 70">Velocity Transaction</choice>
<choice value="O 71">Gambling RFI</choice>
<choice value="O 72">Gambling OFI</choice>
<choice value="O 73">DTTOT Transaction</choice>
<default>*</default>
<fieldForLabel>info</fieldForLabel>
<fieldForValue>info</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
]
| search "End To End Id"="$end_id$" "Status Transaction CI HUB"="$status_cihub$"
| stats count by "Info Transaction CI HUB"
| rename "Info Transaction CI HUB" as info</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<input type="dropdown" token="status_cihub">
<label>Status Transaction CI HUB</label>
<choice value="*">All</choice>
<default>*</default>
<fieldForLabel>status_cihub</fieldForLabel>
<fieldForValue>status_cihub</fieldForValue>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$"
| stats count by "Status Transaction CI HUB"
| rename "Status Transaction CI HUB" as status_cihub</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</input>

<row>
<panel>
<table>
<title>Monitoring Response</title>
<search>
<query>index="x"
| where isnotnull(StatusTransactionBI)
| eval "Status Transaction CI HUB" = if(StatusTransactionBI == "U000", "Success", "Failed")
| lookup statust_description.csv code as StatusTransactionBI OUTPUT description
| rename EndtoendIdOrgnlBI as "End To End Id", StatusTransactionBI as "Code Transaction CI HUB", description as "Description CI HUB"
| dedup "End To End Id"
| join type=outer "End To End Id"
[search index="x"
| where isnotnull(StatusTransactionOrgnl)
| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction",
AddtionalOrgnl == "O 70", "Velocity Transaction",
AddtionalOrgnl == "O 71", "Gambling RFI",
AddtionalOrgnl == "O 72", "Gambling OFI",
AddtionalOrgnl == "O 73", "DTTOT Transaction",
true(), "Other"
)
| rename EndtoendIdOrgnl as "End To End Id"
| search "Info Transaction CI HUB"="$info$"
]
| search "End To End Id"="$end_id$" "Code Transaction CI HUB"="$code_cihub$" "Status Transaction CI HUB"="$status_cihub$"
| table _time, "End To End Id", "Code Transaction CI HUB", "Info Transaction CI HUB", "Status Transaction CI HUB", "Description CI HUB"
| sort - _time</query>
<earliest>$time.earliest$</earliest>
<latest>$time.latest$</latest>
</search>
</table>
</panel>
</row>

the main problem I'm facing is, on the “Info Transaction CI HUB” dropdown that I made static, where if I select one of the values, the contents in the “Monitoring Response” table do not change according to the dropdown value of “Info Transaction CI HUB” that I have selected before.

please help me to solve the problem
Thank you

Re: How do you connected static drop-down to table

ITWhisperer — Thu, 27 Mar 2025 09:58:01 GMT

Your info token equates to a short code yet your search is converting the code to a friendlier term before you search, could this be why your search is not working?

| eval "Info Transaction CI HUB"=case(AddtionalOrgnl == "O 123", "Normal Transaction", AddtionalOrgnl == "O 70", "Velocity Transaction", AddtionalOrgnl == "O 71", "Gambling RFI", AddtionalOrgnl == "O 72", "Gambling OFI", AddtionalOrgnl == "O 73", "DTTOT Transaction", true(), "Other" ) | rename EndtoendIdOrgnl as "End To End Id" | search "Info Transaction CI HUB"="$info$"

topic How do you connected static drop-down to table in Dashboards & Visualizations

How do you connected static drop-down to table

Re: How do you connected static drop-down to table