I have drop down listing down countries . for example my drop down has values as shown below .Now I want to display just two radio buttons instead of drop down ,which should be just UK and US and all the data under US should be US1,US2 .
And Uk radio button should have UK1,UK2,UK3
@navd, you can code the
<change> event handler for the radio button to set this. Based on the the information provided you need something like the following
<change> <condition value="US"> <set token="tokRegionFilter">US1,US2,US3</set> </condition> <condition value="UK"> <set token="tokRegionFilter">UK1,UK2</set> </condition> </change>
Then if you are on Splunk 6.6 or higher, you can use Search Filter using
IN clause. Preferably in the base search for faster results. The following example demonstrates the same approach. It uses
| search Region IN ($tokRegionFilter$) down the line since the previous queries are used to generate the mock data. Similar to the question 3 US and 2 UK regions have been created, the same can be changed/adjusted as per the need.
Following is the Simple XML code for run anywhere example:
<form> <label>Radio Button for setting multiple values</label> <fieldset submitButton="false"> <input type="radio" token="tokRegion" searchWhenChanged="true"> <label>Select Region</label> <choice value="US">US</choice> <choice value="UK">UK</choice> <change> <condition value="US"> <set token="tokRegionFilter">US1,US2,US3</set> </condition> <condition value="UK"> <set token="tokRegionFilter">UK1,UK2</set> </condition> </change> <default>US</default> </input> </fieldset> <row> <panel> <title>Volume by Region</title> <chart> <search> <query>| makeresults | fields - _time | eval Region="US1,US2,US3,UK1,UK2" | makemv Region delim="," | mvexpand Region | eval No_of_Hits=random() | table Region No_of_Hits | search Region IN ($tokRegionFilter$) | sort - No_of_Hits</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search> <option name="charting.chart">bar</option> <option name="charting.drilldown">all</option> <option name="refresh.display">progressbar</option> </chart> </panel> </row> </form>
What is the query for getting the values US1, US2, US3 etc If it is dynamic how would you map US with US1, US2, US3 etc? Do the values actually have some number/pattern in the end (after the name)? If so, can you try the option proposed by @HiroshiSatoh to suffix asterisk