Archive

Select 1st, 2nd, and 3rd items from dropdown menu. Select from dropdown token as an array?

KevinCamacho
Engager

Hello, I have a dropdown menu in my dashboard as so:

 <input type="dropdown" token="gid" searchWhenChanged="true">
      <label>GID</label>
      <fieldForLabel>GID</fieldForLabel>
      <fieldForValue>GID</fieldForValue>
      <search>
        <query>index="omitted for security of company"   sourcetype="omitted for security of company" | stats count by GID | sort by - count</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

What I am trying to do is have 3 panels that will do searches based off the first 3 values in the dropdown, and then have a 4th panel that will do a search based on what the user selects from the dropdown menu. What would be the best way to go about this? My imagined ideal solution is that I can treat $gid$ as an array somehow and just select indexes, but I've been playing around with it and have been unable to get it to work. Any help would be great.

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

You need to use a global base search using the dropdown populating search, and then use those results to drive the panels and the dropdown menu.

The basic XML looks like this

<form>    
  <search id="search_gid_sorted_count">
   <query>
     index="omitted for security of company" sourcetype="omitted for security of company"
     | stats count by GID
     | sort -count
     | streamstats count as ID
   </query>
   <earliest>-24h@h</earliest>
   <latest>now</latest>
    <progress>
      <unset token="search_gid_sorted_count_sid"/>
    </progress>
    <done>
      <set token="search_gid_sorted_count_sid">$job.sid$</set>
    </done>
  </search>

  <fieldset>
    <input type="dropdown" token="gid" searchWhenChanged="true">
     <label>GID</label>
     <fieldForLabel>GID</fieldForLabel>
     <fieldForValue>GID</fieldForValue>
     <search base="search_gid_sorted_count"></search>
     <selectFirstChoice>true</selectFirstChoice>
     </input>
     </fieldset>
  </fieldset>

       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=1 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=2 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=3 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
       ...
    </panel>
       ...      
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" GID=$gid|s$ | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
</form>

View solution in original post

niketnilay
Legend

@KevinCamacho, How would you use the first three values in your first three panels? Would it be top 3 GIDs used in all three panels or one GID for each panel?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

KevinCamacho
Engager

Panel 1 performs a search using the first GID. Panel 2 performs a search using the second GID. Panel 3 performs a search using the third GID.

0 Karma

rjthibod
Champion

You need to use a global base search using the dropdown populating search, and then use those results to drive the panels and the dropdown menu.

The basic XML looks like this

<form>    
  <search id="search_gid_sorted_count">
   <query>
     index="omitted for security of company" sourcetype="omitted for security of company"
     | stats count by GID
     | sort -count
     | streamstats count as ID
   </query>
   <earliest>-24h@h</earliest>
   <latest>now</latest>
    <progress>
      <unset token="search_gid_sorted_count_sid"/>
    </progress>
    <done>
      <set token="search_gid_sorted_count_sid">$job.sid$</set>
    </done>
  </search>

  <fieldset>
    <input type="dropdown" token="gid" searchWhenChanged="true">
     <label>GID</label>
     <fieldForLabel>GID</fieldForLabel>
     <fieldForValue>GID</fieldForValue>
     <search base="search_gid_sorted_count"></search>
     <selectFirstChoice>true</selectFirstChoice>
     </input>
     </fieldset>
  </fieldset>

       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=1 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=2 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" [|loadjob   $search_gid_sorted_count_sid$ | search ID=3 | fields GID] | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
       ...
    </panel>
       ...      
    <panel>
       ...
      <search>
        <query>
          index="omitted for security of company" sourcetype="omitted for security of company" GID=$gid|s$ | ...
        </query>
        <earliest>-24h@h</earliest>
         <latest>now</latest>
      </search>
      ...
    </panel>
       ...
</form>

View solution in original post

KevinCamacho
Engager

Excellent, this worked perfectly for me! I have a follow up question, is there a way I could somehow extract the GID and have it put in the title for the panel? I know how to do that for the user-selected panel, but for the first 3 I don't know how to do it.

0 Karma

rjthibod
Champion

First, please accept my answer if that provided the core of what you needed.

Regarding your new request, you would have to add another invisible search where you can transpose the results and get the values from the first row.

Here is my attempt at such a search. If this works, you can reference the tokens $GID1$, $GID2$, $GID3$ in the panel titles.

   <search base="search_gid_sorted_count">
    <query>
      head 3
      | fields GID ID
      | eval ID = "GID" + ID 
      | transpose header_field=ID
    </query>
     <done>
       <set token="GID1">$result.GID1$</set>
       <set token="GID2">$result.GID2$</set>
       <set token="GID3">$result.GID3$</set>
     </done>
   </search>
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!