topic Re: Need Help on Drop down in Splunk Search

Need Help on Drop down

mahesh27 — Sat, 17 Feb 2024 18:43:52 GMT

Created 2 drop downs in a dashboard.

1. Country

2. Applications (getting data from .csv file)

In applications drop down i am seeing individual applications in the drop down but I need "All" options in the dropdown. How can i do it??

<input type="radio" token="country"> <label>Country</label> <choice value="india">India</choice> <choice value="australian">Australian</choice> <default>india</default> <intialValue>india</intialValue> <change> <condition label="India"> <set token="sorc">callsource</set> </condition> <condition label="Australian"> <set token="sorc">callsource2</set> </condition> </change> </input> <input type="dropdown" token="application" searchWhenChanged="false"> <label>Application</label> <fieldForLabel>application_Succ</fieldForLabel> <fieldForValue>application_Fail</fieldForValue> <search> <query> |inputlookup application_lists.csv |search country=$country$ |sort country application_Succ |fields application_Succ application_Fail</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input> </fieldset>

Re: Need Help on Drop down

ITWhisperer — Sat, 17 Feb 2024 19:46:30 GMT

Add the all choice to the input - you can have both fixed and dynamic choices in the same dropdown

Re: Need Help on Drop down

mahesh27 — Sat, 17 Feb 2024 23:34:08 GMT

Where I should add that, near application drop down??

can u pls share me the code????

Re: Need Help on Drop down

ITWhisperer — Sun, 18 Feb 2024 09:01:01 GMT

<input type="dropdown" token="application" searchWhenChanged="false"> <label>Application</label> <choice value="*">All</choice> <fieldForLabel>application_Succ</fieldForLabel> <fieldForValue>application_Fail</fieldForValue> <search> <query> |inputlookup application_lists.csv |search country=$country$ |sort country application_Succ |fields application_Succ application_Fail</query> <earliest>-15m</earliest> <latest>now</latest> </search> </input>

Re: Need Help on Drop down

mahesh27 — Sun, 18 Feb 2024 19:31:16 GMT

It was so simple, Thank you so much

it worked

😊