All Apps and Add-ons

Pull Down Module Multiple Select

aaronkorn
Splunk Employee
Splunk Employee

Hello,

I have the following dropdown module code but I cannot seem to get it to populate the data from a search and be multi select. Do I have the correct syntax for the population?

`
Last 24 Hours
True

<module name="Pulldown" layoutPanel="panel_row6_col1">


<param name="postProcess">index=xenapp sourcetype=xenapp:65:session earliest=-24h BrowserName=*H1* OR BrowserName=*H3*  | stats values(BrowserName) as app | sort -app</param>
<param name="name">app</param>
<param name="template">app="$value$"</param>
<param name="label">Application:</param>
<param name="size">5</param>
<param name="separator">+OR+</param>
<param name="outerTemplate">( $value$ )</param>

<param name="searchFieldsToDisplay">
  <list>
    <param name="label">app</param>
    <param name="value">app</param>
  </list>
</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Any</param>
    <param name="value">*</param>
  </list>
</param>


<module name="HiddenSearch" layoutPanel="panel_row6_col1" group="Users by Application" autoRun="True">
<param name="groupLabel">Users by Application</param>
<param name="search">index=xenapp sourcetype=xenapp:65:session BrowserName=$app$ | timechart dc(UserName) by BrowserName</param>
<module name="ViewstateAdapter">
  <param name="suppressionList">
    <item>charting.axisTitleX.text</item>
    <item>charting.legend.placement</item>
    <item>charting.axisTitleY.text</item>
    <item>charting.secondaryAxisTitle.text</item>
    <item>count</item>
    <item>charting.chart</item>
    <item>charting.chart.nullValueMode</item>
    <item>displayRowNumbers</item>
    <item>charting.primaryAxisTitle.text</item>
  </param>
  <module name="HiddenFieldPicker">
    <param name="strictMode">True</param>
    <module name="JobProgressIndicator">
      <module name="EnablePreview">
        <param name="display">False</param>
        <param name="enable">True</param>
        <module name="HiddenChartFormatter">
          <param name="charting.axisTitleX.text">Time</param>
          <param name="charting.legend.placement">bottom</param>
          <param name="charting.axisTitleY.text">User Count</param>
          <param name="charting.chart">line</param>
          <param name="charting.chart.nullValueMode">zero</param>
          <module name="JSChart">
            <param name="width">100%</param>
            <module name="Gimp"/>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>




`

0 Karma

aaronkorn
Splunk Employee
Splunk Employee

Nevermind I figured it out. Here is my code if anyone else is interested!

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html" stylesheet="dropdown_align.css">






1
*
False



1
splunk.search.job
True
warn

<module name="TimeRangePicker" layoutPanel="panel_row1_col1">
<param name="default">Last 24 Hours</param>
<param name="searchWhenChanged">True</param>


index=xenapp sourcetype=xenapp:65:session BrowserName=H1 OR BrowserName=H3 | dedup BrowserName | sort -BrowserName

<module name="JobProgressIndicator"></module>
<module name="Pulldown" layoutPanel="panel_row1_col1">
                <param name="name">BrowserName</param>
    <param name="template">BrowserName="$value$"</param>
<param name="label">Application:</param>
<param name="size">10</param>
<param name="separator">+OR+</param>
<param name="outerTemplate">( $value$ )</param>

    <param name="searchFieldsToDisplay">
        <list>
    <param name="label">BrowserName</param>
    <param name="value">BrowserName</param>
  </list>
</param>


<module name="SubmitButton">
<module name="Search" layoutPanel="panel_row1_col1" group="Users by Application" autoRun="True">
<param name="groupLabel">Users by Application</param>
<param name="search">index=xenapp sourcetype=xenapp:65:session BrowserName=*H1* OR BrowserName=*H3* $BrowserName$ | timechart limit=20 dc(UserName) by BrowserName useother=f</param>
<module name="ViewstateAdapter">
  <param name="suppressionList">
    <item>charting.axisTitleX.text</item>
    <item>charting.legend.placement</item>
    <item>charting.axisTitleY.text</item>
    <item>charting.secondaryAxisTitle.text</item>
    <item>count</item>
    <item>charting.chart</item>
    <item>charting.chart.nullValueMode</item>
    <item>displayRowNumbers</item>
    <item>charting.primaryAxisTitle.text</item>
  </param>
  <module name="HiddenFieldPicker">
    <param name="strictMode">True</param>
    <module name="JobProgressIndicator">
      <module name="EnablePreview">
        <param name="display">False</param>
        <param name="enable">True</param>
        <module name="HiddenChartFormatter">
          <param name="charting.axisTitleX.text">Time</param>
          <param name="charting.legend.placement">bottom</param>
          <param name="charting.axisTitleY.text">User Count</param>
          <param name="charting.chart">line</param>
          <param name="charting.chart.nullValueMode">zero</param>
          <module name="JSChart">
            <param name="width">100%</param>
            <module name="Gimp"/>
            <module name="ConvertToDrilldownSearch">
              <module name="ViewRedirector">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>






0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...