topic What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3? in Splunk Search

What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

dwalker1 — Tue, 24 Feb 2015 20:55:16 GMT

Hi Folks,

I have a dashboard that automatically populates a drop-down based on a search with CDATA. I want to be able to actually type into the box, say a specific IP, and as I'm typing it, have it do an on-demand filter. The closest I've been able to do is a "multi-select" input instead of a drop-down. Does anyone know the easiest way to do this?

Thanks!

Re: What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

somesoni2 — Tue, 24 Feb 2015 22:32:42 GMT

For Splunk 6.1.X version, multiselect is option to get the dropdown with text field. This feature is available (brought back) in Splunk 6.2

Re: What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

dwalker1 — Wed, 25 Feb 2015 18:50:17 GMT

Would you be able to only have it default to one selection?

Re: What is the easiest way to create an input filter for a dynamic Drop-down Splunk 6.1.3?

ngatchasandra — Tue, 17 Mar 2015 09:41:05 GMT

Hi,
In Splunk 6.2, this is possible . When you type for example a specific sourcetype in my case, the input will automatically filter the sourcetype who macth to that sourcetype. My XML code with CDATA! is:

<form>
  <label>Dashboard_Filter</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="true">
      <label>Select Sourcetype</label>
      <search>
        <query><![CDATA[index=_internal | table sourcetype]]></query>
      </search>
      <fieldForLabel>sourectype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by sourcetype</query>
          <earliest></earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>