Dashboards & Visualizations

Populate second drop down based on first drop down selection ?

vikas_gopal
Builder

Hi Experts,

I have one static drop down , it has 2 static value "stage and Prod". Now I want to display values in the second drop down based on first drop down selection . So second drop down shows staging servers only if first selection was stage and vice versa.

to be more specific
If Drop down 1 = stage
Drop down 2 = abc_stage1,abc_stage2 (using a query )

IF Drop down 2 = prod
Drop down 2 = abc_prod1,abc_prod2 (using a query )

Please help

VG

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

View solution in original post

DDivagarInfant
Engager

Can you share the soluition?

0 Karma

woodcock
Esteemed Legend

I agree with the other answer but to answer your literal question, try code like this:

<input type="text" token="server_partial" searchWhenChanged="false">
    <label>RegEx filter for Server Dropdown --&gt;</label>
    <default>.</default>
</input>
<input type="dropdown" token="server" searchWhenChanged="false">
    <label>(&lt;-- filtered) Server Selector:</label>
    <default>*</default>
    <choice value="*">All</choice>
    <fieldForLabel>server</fieldForLabel>
    <fieldForValue>server</fieldForValue>
    <search>
        <query>| inputcsv serverlist.csv | regex server="(?i)$server_partial$" | table server</query>
        <earliest>-1s</earliest>
        <latest>now</latest>
    </search>
</input>
0 Karma

vikas_gopal
Builder

I can see all staging servers have stage string in it and all prod has prod string in the server name .

0 Karma

jkat54
SplunkTrust
SplunkTrust

How do you know that a server is staging or prod?
Typically there is a naming convention...

Let's assume production servers have the letter P as the third character:

aaPxxx <-prod
aaSxxx <- staging

Now your first drop down has value P for Production and value S for staging and env is the name of the token.

In your second drop down you would populate it with this search:

 index=AIndexWithAllHosts | dedup host | rex field=host "..($<env>.)" | search env=$env$ | fields host | sort host

And you use host as the field for the values.

vikas_gopal
Builder

Thank you Man,

Works like charm.

jkat54
SplunkTrust
SplunkTrust

A lot of people prefer to use | metadata type=hosts instead of index=AIndexWithAllHosts

0 Karma

vikas_gopal
Builder

Got another situation , now I am preparing a table based on above 2 inputs . When it is stage + All in second I want to see only stage servers in the table below . What it is doing in table is, it is giving me overall servers details that is for both stage and prod . For table I tried this but with this no data appears

index=abc  source=computer host=$host$ $env$| sort Name  |table Name,Domain, Manufacturer, Model|dedup Name,Domain, Manufacturer, Mode

I know this is because of $env$ as it is searching for P or S.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...