topic Re: Using token from previous populating search within a second populating search in Splunk Search

Using token from previous populating search within a second populating search

bcarr12 — Fri, 27 Jun 2014 17:03:18 GMT

Hi all,

I am currently using a populating search for several dropdowns in a dashboard. I have one for location, device name, time range etc. I am trying to set up the dashboard in such a way that the location selected will then be plugged into my other populating searches (device name for instance), so only devices for the given location will be showed as options in the dropdown. Is this possible?

Example:
Location

 <input type="dropdown" token="Location">
    <label>Location</label>
    <choice value="*">All Location</choice>
    <populatingSearch fieldForValue="aa" fieldForLabel="aa">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | stats count by aa]]>
    </populatingSearch>

Devices
(Populating search will show all devices regardless of location. I would like this to show only devices in the location I specify in the previous dropdown)

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m | stats count by DeviceName]]>
    </populatingSearch>
</input>

Re: Using token from previous populating search within a second populating search

somesoni2 — Fri, 27 Jun 2014 17:46:02 GMT

Try this in dropdown xml for Device

<input type="dropdown" token="Device">
    <label>Device</label>
    <choice value="*">All Devices</choice>
    <populatingSearch fieldForValue="DeviceName" fieldForLabel="DeviceName">
          <![CDATA[index=my_index sourcetype=syslog earliest=-60m |rex field=Location "All Locations\#(?<aa>\w+)" | search aa="$Location$" | stats count by DeviceName ]]>
    </populatingSearch>
</input>

Re: Using token from previous populating search within a second populating search

bcarr12 — Fri, 27 Jun 2014 18:20:39 GMT

Hmm, that doesn't seem to be working...now the dropdown only shows "All Devices". I think the problem is that the dropdowns all populate the moment the dashboard starts, how do I tell the Device to only populate once I have specified Location in the prior dropdown?

Re: Using token from previous populating search within a second populating search

somesoni2 — Fri, 27 Jun 2014 19:05:48 GMT

The dropdown should show "All Devices" only at page load. Does it show "All Devices" only event after selecting a Location?

Re: Using token from previous populating search within a second populating search

bcarr12 — Mon, 30 Jun 2014 16:30:54 GMT

It shows "All Devices" after page load and it remains that way after I have selected a location as well.

Re: Using token from previous populating search within a second populating search

somesoni2 — Mon, 30 Jun 2014 17:32:49 GMT

What version of Splunk are you using?

Re: Using token from previous populating search within a second populating search

bcarr12 — Tue, 01 Jul 2014 18:33:30 GMT

I am using 4.3.5 right now but hope to be on 6.1 soon which I am sure will probably resolve issues like this one!