All Apps and Add-ons

Passing values from one Pulldown to another

vaishnavi07
Explorer




2
*
False

<!-- Drop down for sourcetype -->


index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype


sourcetype
sourcetype
left

sourcetype

</module>

<!-- Drop down for counter -->


index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="\b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)

column
column

column


In the above code the first pulldown value sourcetype is not getting passed to the second pulldown module. $sourcetype$ is not getting the value. I dunno if am missing anyhthing. Does anyone know how to solve this issue?

Thanks in advance.

sideview
SplunkTrust
SplunkTrust

You need to nest the second Pulldown inside the first. In module-framework-speak, the second Pulldown needs to be "downstream" from the first. If this isn't a familiar concept to you yet, take a few minutes to read the "Introduction to the Advanced XML" page in Sideview Utils and all will be explained. Or at least much.

In combining these I also consolidated your "autoRun" attributes. Also take special care to never nest a module with autoRun=True inside another module with autoRun="True".

<module name="Search" layoutpanel="viewHeader" autoRun="True">
  <param name="search">
    index="winserver_perf" earliest=-1m latest=now| table sourcetype | dedup sourcetype
  </param>
  <module name="Pulldown">
    <param name="name">sourcetype</param>
    <param name="label">sourcetype</param>
    <param name="float">left</param>
    <param name="staticOptions"/>
    <param name="valueField">sourcetype</param>
  </module>

  <module name="Search">
    <param name="search">index="winserver_perf" sourcetype="$sourcetype$" earliest=-1m latest=now | transpose | regex column="b[A-Z][a-zA-Z_/]|%[_A-Za-z]" | dedup column | table column | sort +str(column)</param>
    <module name="Pulldown">
      <param name="name">column</param>
      <param name="label">column</param>
      <param name="staticOptions"/>
      <param name="valueField">column</param>
    </module>
  </module>
</view>
0 Karma

somesoni2
Revered Legend

The second pulldown module should be nested within first pulldown module.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...