dual dropdown question

[ringbbg]

Hi everyone. I am trying to create a splunk dashboard to record the faults in our global network.
Basically, I want to create a 2 dropdown, where the first one, "Select region" will pick the region where the events happened, and the second dropdown will autopopulate with hostnames that had outages from the region selected on the first dropdown. Selecting the hostnames on the second dropdown will in turn display the event on the table.

[Code Sample]
HOwever, i would like to put a in the second dropdownnamed ALL. This ALL value will depend on the first dropdown region, so if 1st dropdown is equals to APAC, then second dropdown ALL will be equal to ALL APAC hostnames only...So basically, aside from the hostnames updating dyanmically based on the region in the first dropdown, the value of ALL will also depend on the region selected in the first dropdown. Is this possible? Right now, I can only assign one value on the ALL of the second dropdown..

index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$host_name$
ＴＥＳＴ

<input type="time" token="_time" searchWhenChanged="true">
  <label>Time range</label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="region" searchWhenChanged="true">
  <label>Select Region</label>
  <choice value="*">All</choice>
  <choice value="toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*">APAC</choice>
  <choice value="metro* OR morristown* OR njr* OR njr1* OR ny* OR orange* OR secaucus* OR skillman* OR telx* OR weehawken* OR west* OR wilmington* OR ashburn* OR atlanta* OR boston* OR columbus* OR calgary* OR dcb* OR markham* OR miami* OR montreal* OR ottawa* OR southfield* OR toronto* OR vanc* OR washington* OR chicago* OR dallas* OR houston* OR kansas* OR losan* OR sanfran* OR seattle* OR bermuda* OR bogota* OR brasilia* OR buenos* OR caracas* OR lima* OR  mexico* OR monte* OR rio* OR santiago* OR saop*">AMER</choice>
  <choice value="abud* OR bahr* OR bucking* OR cairo* OR canning* OR capetown* OR citygate* OR dockland* OR dubai* OR dublin* OR guernsey* OR jersey-u* OR johannesburg* OR kuwait* OR lagos* OR qatar* OR riyadh* OR slough* OR telaviv* OR uae* OR zurich* OR amsterdam* OR athens* OR barcelona* OR brussels* OR budapest* OR copenhagen* OR dusseldorf* OR frankfurt* OR friesstrasse* OR geneva* OR hamburg* OR helsinki* OR istanbul* OR lisbon* OR luxembourg* OR madrid* OR milan* OR monaco* OR moscow* OR munich* OR oslo* OR paris* OR prague* OR rome* OR stockholm* OR stuttgart* OR vienna* OR warsaw* OR zurich*">EMEA</choice>
  <default>*</default>
</input>
<input type="dropdown" token="hostname" searchWhenChanged="true">
  <label>Select Host</label>
  <search>
  <query>index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$region$ | top host</query>
  <earliest>$_time.earliest$</earliest>
  <latest>$_time.latest$</latest>
  </search>
  <fieldForlabel>host</fieldForlabel>
  <fieldForValue>host</fieldForValue>
  <choice value="*">All</choice>
  <default>*</default>
  </input>


<panel>
  <table>
    <title>CFM Monitoring</title>
    <search>
      <query>index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$hostname$ | dedup host | table _time, host, int, cfmpro, syslog_message | sort 0 -_time</query>
      <earliest>$_time.earliest$</earliest>
      <latest>$_time.latest$</latest>
    </search>
    <option name="count">20</option>
  </table>
</panel>

[rjthibod · Accepted solution]

You would use the change and condition features on the first dropdown to dynamically change the second one.

Add the following to the first dropdown to achieve the outcome you described of setting "hostname" to All when the APAC region is selected.

 ...
  <change>
    <condition label="APAC">
      <set token="form.hostname">*</set>
    </condition>
  </change>
</input>

[ringbbg]

thanks for replying. it worked! is there a way to set the label as well? like for example i want this below

 <condition label="APAC">
   <set token="form.hostname">toyosu* OR daikan*</set>
 </condition>

the problem is the second dropdown will show "toyosu* OR daikan*" label when first drop down is selected. The thing works but id like to edit the label as well. like say value of "toyosu* OR daikan*" but actually showing "All"

[rjthibod]

If I understand you correctly, you would have to change

<choice value="*">All</choice>

In the second dropdown to

`All

In general, the value you assign to the token has to correspond to the actual value you want for the dropdown. The label element is only for what shows in the text.

If this is not clear, then I would have to ask you to rephrase what you meant.

[ringbbg]

sorry for the confusion.
I basically removed that All in the second dropdown.
In the first dropdown it is now.

  <condition label="All">
    <set token="form.hostname">*</set>
    <set label="$form.hostname">All</set>
    </condition>
  <condition label="APAC">
    <set token="form.hostname">toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*</set>
    </condition> 
  <condition label="EMEA">
    <set token="form.hostname">abud* OR bahr* OR bucking* OR cairo* OR canning* OR capetown* OR citygate* OR dockland* OR dubai* OR dublin* OR guernsey* OR jersey-u* OR johannesburg* OR kuwait* OR lagos* OR qatar* OR riyadh* OR slough* OR telaviv* OR uae* OR zurich* OR amsterdam* OR athens* OR barcelona* OR brussels* OR budapest* OR copenhagen* OR dusseldorf* OR frankfurt* OR friesstrasse* OR geneva* OR hamburg* OR helsinki* OR istanbul* OR lisbon* OR luxembourg* OR madrid* OR milan* OR monaco* OR moscow* OR munich* OR oslo* OR paris* OR prague* OR rome* OR stockholm* OR stuttgart* OR vienna* OR warsaw* OR zurich*</set>
    </condition>  
  <condition label="AMER">
    <set token="form.hostname">metro* OR morristown* OR njr* OR njr1* OR ny* OR orange* OR secaucus* OR skillman* OR telx* OR weehawken* OR west* OR wilmington* OR ashburn* OR atlanta* OR boston* OR columbus* OR calgary* OR dcb* OR markham* OR miami* OR montreal* OR ottawa* OR southfield* OR toronto* OR vanc* OR washington* OR chicago* OR dallas* OR houston* OR kansas* OR losan* OR sanfran* OR seattle* OR bermuda* OR bogota* OR brasilia* OR buenos* OR caracas* OR lima* OR  mexico* OR monte* OR rio* OR santiago* OR saop*</set>
 </condition>
 </change>

while the second is:

  <input type="dropdown" token="hostname" searchWhenChanged="true">
  <label>Select Host</label>
  <search>
  <query>index=nm "CFM defect" syslog_message!="CFM defect: none*" host=$region$  | top host</query>
  <earliest>$_time.earliest$</earliest>
  <latest>$_time.latest$</latest>
  </search>
  <fieldForlabel>host</fieldForlabel>
  <fieldForValue>host</fieldForValue>
  </input>

When i select APAC for example in the first dropdown, the value corresponds to ["toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*" ] as per what i set in the condition on the first dropdown, and the resulting data is correct.

The thing is, the 2nd dropdown shows the whole value as well. So when i select APAC in the first dropdown, i get " ["toyosu* OR daikan* OR hongkong* OR singapore* OR sydney* OR taipei* OR seoul* OR tokyo* OR osaka* OR manila* OR beijing* OR tsuenwan* OR shenzhen* OR shanghai* OR jakarta* OR kualalumpur* OR mumbai* OR bangkok* OR wellington* OR melbourne* OR canberra*" ] as well for the lable in the second dropdown. What i want to do is carry over the value, but change the label to something different. So if i slect APAC in first dropdown, the value will be what i set in the condition, but the menu in the 2nd dropdown is not the whole value but lets say show as "All"

Im sorry for confusing you. Thanks for taking the time to reply