topic Re: Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values in Dashboards & Visualizations

Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

ramuzzini — Fri, 10 Jan 2025 22:06:07 GMT

Working on a dashboard in dashboard studio to display data in two different tables using a single dropdown. Issue I have is that all my data is determined by the "username" field but want to have dropdown display user Lastname, Firstname for better visibility.

First table pulls records from a lookup table with user demographics and such. Second table is pulling respective window log data tracking various user activity.

In my dropdown, I am currently using the lookup table and eval function to join both "user_last", "user_first" set variable to "fullname" and display User "Lastname, Firstname". I then used "fullname" as the pass-on token for my first table. However, my second table, I need the "username" as the token because the data I am querying only has the "username" in the logs and not the users first or last name as my first table.

My question is can I set my dropdown to display "user_last, user_first" names but set the token value as "username" or can I assign multiple tokens in a SPL query in Dashboard Studio to use in the respective tables or can I do both for sake of knowledge.

Here is what I am working with and appreciate any assistance with this.

Lookup table:
Name: system_users.csv
Fields: username, name_last, name_first....

Dashboard Dropdown Field Values:
Data Source Name: lookup_users

SPL Query:

| inputlookup bpn_system_users.csv | eval fullname= name_last.", ".name_first | table fullname | sort fullname

Source Code:

{ "type": "ds.search", "options": { "queryParameters": { "earliest": "$SearchTimeLine.earliest$", "latest": "$SearchTimeLine.latest$" }, "query": " | inputlookup system_users.csv\n | eval fullname= name_last.\", \".name_first\n | table fullname\n | sort fullname" }, "name": "lookup_users" }

Re: Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

VatsalJagani — Thu, 23 Jan 2025 06:06:03 GMT

@ramuzzini- I'm not sure if it is feasible with Dashboard Studio. But it is possible to do with regular Splunk Simple XML (Classic) dashboard.

In Simple XML dashboard you can use <change> effect and use $value$ for username & $label$ to get full username.

Here is the reference which is similar to what you are looking for but in Simple XML dashboard - https://community.splunk.com/t5/Dashboards-Visualizations/How-to-set-two-tokens-off-one-dropdown-in-dashboard/m-p/408734

(Please take some time to review this and learn, I know if you don't have much experience with Simple XML Dashboard then it may take some time to understand it.)

I hope this helps!!! Kindly upvote if it does!!!

Re: Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

ramuzzini — Tue, 08 Apr 2025 17:50:01 GMT

Thanks for the feedback. I was able to make this work in simple XML with what you provided. As I started learning Splunk, I have been working solely with Dashboard Studio but quickly realized some of the queries I am wanted to run only run in simple XML. Again, appreciate the assistance.

Re: Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

VatsalJagani — Thu, 10 Apr 2025 08:32:48 GMT

@ramuzzini- Glad to hear that you are able to resolve the issue. Please kindly click on my answer with "Accept as Solution" so that future Splunk users can get benefited from it as they see it solution that worked for you.

Re: Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

zahid — Mon, 19 May 2025 17:01:20 GMT

Is this still unfeasible with the Studio mode? There are many usecases where we need to reset multiple dropdowns based on a specific dropdown (e.g. if country is changed, we should not have the city stay the same as it no longer belongs to the selected country, etc.)