topic splunk framework form dropdown problem in Dashboards & Visualizations

splunk framework form dropdown problem

Federica_92 — Mon, 16 Feb 2015 12:20:06 GMT

Hi all,
I'm trying to make a simple dropdown in splunk framework that visualize all my source.
What I'm suppose to insert in the block content, to visualize the dropdown?
And I would like use the results of the search instead of 1, 2, 3, How I can do this?

{% extends "splunkdj:base_with_app_bar.html" %}
{% load splunkmvc %}

{% block content %}


{% endblock content%}

{% block js %}
    <script>
    var deps = [
            "splunkjs/ready!",
            "splunkjs/mvc/searchmanager",
            "splunkjs/mvc/dropdownview"
        ];

        require(deps, function(mvc) {
            var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
                id: "mysearch-log",
                search: "index=waratek | stats dc(source) by source | eval rule=source | fields rule"
            });

    var DropdownView = require("splunkjs/mvc/dropdownview");
        new DropdownView({
            id: "drop-list",
            default: "One",
            el: $("#divToHangOn")
        }).render();


    var choices = [{label: " One", value: "One"},
        {label:" Two", value: "Two"},
        {label:" Three", value: "Three"}];

    //I would like use the results of the search instead of this 3 values
    //like=label:" Two", value: rule[2]
    //like=label:" Three", value: rule[3]


    splunkjs.mvc.Components.getInstance("drop-list").settings.set("choices", choices);

        var sbg = splunkjs.mvc.Components.getInstance("drop-list");
        var sbResult = document.getElementById("example-dropdown-result");
        sbg.on("change", function(){
            sbResult.innerHTML = sbg.val();
        });

//write the drop-list click in a in a file

        });
    </script>
{% endblock js %}

Thank you

Re: splunk framework form dropdown problem

Raghav2384 — Mon, 16 Feb 2015 13:07:22 GMT

Please take a look at this

 http://dev.splunk.com/view/SP-CAAAEN4  (On the right hand side, you have step by step instructions)

{block managers} will hold the search and {block content} will contain the type of visualization you want for the searches.

Also, are you looking for total # of sources in a index? or count of events per source ?

index=waratek|stats count as Events by source? Hope this helps

Thanks,
Raghav

Re: splunk framework form dropdown problem

Federica_92 — Mon, 16 Feb 2015 13:42:37 GMT

Thank you for your reply, I would like create a dropdown menu to select " rul1 " or "rul2" or "rul3" that are all my source if I search index=waratek.
So yeah: index=waratek | stats dc(source) (And in splunk works perfectly, give me the correct results).

The problem is that If I create this query and next I try to make something like this:
{block content..
{% dropdown id="list" managerid="list-search" %}

and in search, or in the javascript code I add the query:
index=waratek | stats dc(source) by source | fields source

I'll obtain an error like"Duplicate labels causing conflict splunk"

So I'm trying with "var choices = [{label: " One", value: "One"},
{label:" Two", value: "Two"},
{label:" Three", value: "Three"}];"
But I would like use instead of these values (one, two..), the results of my previously query (rul1, rul2..)
And next take this value to create another query.

Please, how I can make this?
Thank you a mil