Dashboards & Visualizations

2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

Motivator

TLDR;
I have 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

I have 2 dropdowns
1/ selects the day of the week and that then draws the gragh for that day
example of search, where $select_wday$ is the variable that would change from the dropdown:

timechart span=5m max(globalStatActiveSubscribers) by device |
        eval wday = strftime(_time, "%a") |
        where wday = "$select_wday$" |
        fields - wday |
        timewrap d series=exact

2/ I want this to control whether timewrap is a weekly view or daily view
but it has a variable inside a variable ( $select_wday$ is inside $week_or_day_view$)
example of search,

timechart span=5m max(globalStatActiveSubscribers) by device | $week_or_day_view$

The 2 dropdowns:

1/

<input type="dropdown" token="select_wday">
  <label>Select Day:</label>
  <choice value="Mon">Mon</choice>
  <choice value="Tue">Tue</choice>
  <choice value="Wed">Wed</choice>
  <choice value="Thu">Thu</choice>
  <choice value="Fri">Fri</choice>
  <choice value="Sat">Sat</choice>
  <choice value="Sun">Sun</choice>
  <default>$Date$</default>
</input>

2/

<input type="dropdown" token="week_or_day_view">
  <label>Week/Day View:</label>
  <choice value='eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
  <choice value="timewrap d series=exact">week</choice>
  <default>day</default>
</input>

Dropdown 1 works on its own, but when I introduce dropdown 2 it does not work.

Dropdown 2 works for choice2 but not for choice 1 becuase of the variable $select_wday$ inside that choice.

Maybe related:
https://answers.splunk.com/answers/558791/dropdown-based-on-another-dropdown.html?utm_source=typeahe...
https://answers.splunk.com/answers/233717/the-formatting-of-a-graph-is-not-holding-for-the-d.html?ut...
https://answers.splunk.com/answers/79678/dropdown-question.html?utm_source=typeahead&utm_medium=newq...
https://answers.splunk.com/answers/239138/how-do-i-make-a-dropdown-dynamic-based-on-a-feedse.html?ut...
https://answers.splunk.com/answers/235589/how-to-clear-dropdown-box.html?utm_source=typeahead&utm_me...
https://answers.splunk.com/answers/680173/how-can-i-retrieve-another-field-value-from-dashbo.html?ut...

0 Karma
1 Solution

Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Motivator

tks @niketnilay. that works and more tks for the cascade effect. Very Nice!

Legend

😄 Anytime... Glad you found this useful!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Builder

Can you rewrite your 2nd dropdown something like below and try?

My reply was somehow removing the correct formatting. So, I have removed "<" from each line below. Hope you get what I am trying to say.

"
input type="dropdown" token="week_or_day_view">
label>Week/Day View:
default>-
choice value="-">
initialValue>-
fieldForLabel>wday
fieldForValue>wday
search>
query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact
earliest>0
/search>
/input>
"

Motivator

tks, but I think I am only guessin, this is what I tried. I could get the code to look right but not sure if I can get it to work, or indeed if it can work. tks though. let me know if can explain it better.

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View2:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
    <choice value=' eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>

</input>

another:

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View3:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<search>
<query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact </query>
<earliest>0</earliest>
</search>
</input>
0 Karma

Builder

Can you share your full code? Below code will always run against current time and will not take you to other days. That's the reason it might not be working

eval wday = strftime(_time, "%a")

And below code will exclude wday from your output. So, you can't assign it to the token week_or_day_view

fields - wday

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!