Dashboards & Visualizations

How can I append a second chart drill down to an existing input?

andrewtrobec
Motivator

Hello,

I'm trying to get a chart drill down to pass multiple values to a dashboard multiselect input. The scenario is that I have a column chart and the columns that I click on get added as filter criteria to the input. First we have the muliselect:

<input type="multiselect" token="token_tok">
  <label>Configuration Item</label>
  <delimiter> </delimiter>
  <choice value="Value 1">Value 1</choice>
  <choice value="Value 2">Value 2</choice>
  <choice value="Value 3">Value 3</choice>
</input>

Then with the column chart I have the following drill down code:

<drilldown>
  <set token="form.token_tok">$form.token_tok$,$click.value$</set>
</drilldown>

The idea is to have the drill down append the selected value so that the input updates with the values. I thought that maybe adding a , would cause the values to be parsed into the multiselect values, but this doesn't work. Instead I end up with a single invalid value consisting of the token value, a comma, and the value selected from the chart.

Is there a way of getting around my problem?

Thank you and best regards,

Andrew

Tags (1)
0 Karma

mdelwaide
Path Finder

Hi Andrew,

Have you tried a background search to merge both token value? I did a small test on my local Splunk and it seems to be working.

<form>
  <label>test</label>
  <search>
    <query>| makeresults | eval merge="$value1$,$value2$"</query>
    <preview>
      <set token="valuemerge">$result.merge$</set>
    </preview>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="value1">
      <label>field1</label>
      <choice value="Test">Test</choice>
      <choice value="Test1">Test1</choice>
    </input>
    <input type="dropdown" token="value2">
      <label>field2</label>
      <choice value="Test2">Test2</choice>
      <choice value="Test3">Test3</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $value1$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $value2$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $valuemerge$
      </html>
    </panel>
  </row>
</form>

I've simulated both of your input with static dropdown, when both are set, the 3rd value (merge) is calculated.
alt text

Also when you change on of the inputs, the 3rd field is recalculated

Hope this will help you

Regards

M.

0 Karma

andrewtrobec
Motivator

Hello, and thank you for taking the time.
i see what you've done, but what I'm trying to do is slightly different. Adding on to your example, what I'd like to do is have a multiselect input that when passed values (in this case "Test,Test3"), automatically parses them into the their individual values. The result would be:

alt text

The values Test and Test3 would be columns selected from a column chart. Is this possible?

Regards,

Andrew

0 Karma

mdelwaide
Path Finder

Hi Andrew,

It seems it's something you can't do out of the box, but I was able to populate a multiselect dropdown with tokens. But it's not possible to automatically populate the multiselect box with those value.

Although I found a javascript that allows you to automatically select the first value of your multiselect, maybe with a bit of coding you'll be able to arrange the code to automatically set all the available value to be selected.

Regards

M.

https://gist.github.com/hobbes3/7c52b67c1de5ba4d9dfe

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="value1">
      <label>field1</label>
      <choice value="Test">Test</choice>
      <choice value="Test1">Test1</choice>
    </input>
    <input type="dropdown" token="value2">
      <label>field2</label>
      <choice value="Test2">Test2</choice>
      <choice value="Test3">Test3</choice>
    </input>
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <search>
        <query>| makeresults | eval Title="$value1$,$value2$" | makemv delim="," Title | mvexpand Title | appendcols [| makeresults | eval Value = "$value1$,$value2$" | makemv delim="," Value | mvexpand Value] | fields Title,Value</query>
      </search>
      <fieldForLabel>Title</fieldForLabel>
      <fieldForValue>Value</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        $value1$
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <html>
        $value2$
      </html>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...