All Apps and Add-ons

Passing values from one Pulldown to another

vaishnavi07
Explorer




2
*
False

<!-- Drop down for sourcetype -->


index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype


sourcetype
sourcetype
left

sourcetype

</module>

<!-- Drop down for counter -->


index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="\b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)

column
column

column


In the above code the first pulldown value sourcetype is not getting passed to the second pulldown module. $sourcetype$ is not getting the value. I dunno if am missing anyhthing. Does anyone know how to solve this issue?

Thanks in advance.

sideview
SplunkTrust
SplunkTrust

You need to nest the second Pulldown inside the first. In module-framework-speak, the second Pulldown needs to be "downstream" from the first. If this isn't a familiar concept to you yet, take a few minutes to read the "Introduction to the Advanced XML" page in Sideview Utils and all will be explained. Or at least much.

In combining these I also consolidated your "autoRun" attributes. Also take special care to never nest a module with autoRun=True inside another module with autoRun="True".

<module name="Search" layoutpanel="viewHeader" autoRun="True">
  <param name="search">
    index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype
  </param>
  <module name="Pulldown">
    <param name="name">sourcetype</param>
    <param name="label">sourcetype</param>
    <param name="float">left</param>
    <param name="staticOptions"/>
    <param name="valueField">sourcetype</param>
  </module>

  <module name="Search">
    <param name="search">index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)</param>
    <module name="Pulldown">
      <param name="name">column</param>
      <param name="label">column</param>
      <param name="staticOptions"/>
      <param name="valueField">column</param>
    </module>
  </module>
</view>
0 Karma

somesoni2
Revered Legend

The second pulldown module should be nested within first pulldown module.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...