All Apps and Add-ons

Passing values from one Pulldown to another

vaishnavi07
Explorer




2
*
False

<!-- Drop down for sourcetype -->


index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype


sourcetype
sourcetype
left

sourcetype

</module>

<!-- Drop down for counter -->


index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="\b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)

column
column

column


In the above code the first pulldown value sourcetype is not getting passed to the second pulldown module. $sourcetype$ is not getting the value. I dunno if am missing anyhthing. Does anyone know how to solve this issue?

Thanks in advance.

sideview
SplunkTrust
SplunkTrust

You need to nest the second Pulldown inside the first. In module-framework-speak, the second Pulldown needs to be "downstream" from the first. If this isn't a familiar concept to you yet, take a few minutes to read the "Introduction to the Advanced XML" page in Sideview Utils and all will be explained. Or at least much.

In combining these I also consolidated your "autoRun" attributes. Also take special care to never nest a module with autoRun=True inside another module with autoRun="True".

<module name="Search" layoutpanel="viewHeader" autoRun="True">
  <param name="search">
    index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype
  </param>
  <module name="Pulldown">
    <param name="name">sourcetype</param>
    <param name="label">sourcetype</param>
    <param name="float">left</param>
    <param name="staticOptions"/>
    <param name="valueField">sourcetype</param>
  </module>

  <module name="Search">
    <param name="search">index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)</param>
    <module name="Pulldown">
      <param name="name">column</param>
      <param name="label">column</param>
      <param name="staticOptions"/>
      <param name="valueField">column</param>
    </module>
  </module>
</view>
0 Karma

somesoni2
Revered Legend

The second pulldown module should be nested within first pulldown module.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...