Splunk Dev

A dropdown menu within a panel and change in the search query based on input selection

ssamant007
Explorer

I want to add a dropdown selection menu inside a dashboard panel using html and then based on the selected item from the dropdown , need to change the search query accordingly and results are updated in the chart visualization.

Example:

 Select Month:   All, Jan, Feb, ...Dec.

Now when user selects all, the query will display results for entire year (jan -dec) and when jan is selected then chart is displayed only showing the entire january data. Similarly for others.

I have other different panels within the dashboard under differet rows, and  I need to insert the drop down menu only for a specific panel. Also, my base search remains same irrespective of the drop-down selection, only the panel search string changes with change in the dropdown selection.

- any suggestion or guide would be a great help. It would be nice if it can be done with no or minimal use of JavaScript.

TIA

thanks

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Add a dropdown input to the row with the panel you want to filter and use the token from the dropdown in the search for that panel. The search can still be based on your initial search query, it is just applying some filtering.

View solution in original post

ssamant007
Explorer

Thanks @ITWhisperer  & @RickvdlJ . I built the solution based on the idea suggested.

0 Karma

RickvdIJ
Explorer

<row>

    <panel>

      <title>panel_in_dashboard</title>

      <input type="dropdown" token="hosttoken">

        <label>host-token</label>

        <fieldForLabel>host</fieldForLabel>

        <fieldForValue>host</fieldForValue>

        <search>

          <query>| tstats c where index=test by host | table host</query>

          <earliest>-15m@m</earliest>

          <latest>now</latest>

        </search>

      </input>

      <chart>

        <title>test</title>

        <search>

          <query>| tstats c where index=test host=$hosttoken$ by host</query>

          <earliest>-15m@m</earliest>

          <latest>now</latest>

        </search>

        <option name="charting.chart">line</option>

        <option name="charting.drilldown">none</option>

        <option name="refresh.display">progressbar</option>

      </chart>

    </panel>

 

-----

Now you have a dropdown menu in your dashboard panel with a token. This token is used in the panel-search.

Currently, the dropdown is populated by a search, but you can also include static values.

ITWhisperer
SplunkTrust
SplunkTrust

Add a dropdown input to the row with the panel you want to filter and use the token from the dropdown in the search for that panel. The search can still be based on your initial search query, it is just applying some filtering.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...