Dashboards & Visualizations

2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

HattrickNZ
Motivator

TLDR;
I have 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

I have 2 dropdowns
1/ selects the day of the week and that then draws the gragh for that day
example of search, where $select_wday$ is the variable that would change from the dropdown:

timechart span=5m max(globalStatActiveSubscribers) by device |
        eval wday = strftime(_time, "%a") |
        where wday = "$select_wday$" |
        fields - wday |
        timewrap d series=exact

2/ I want this to control whether timewrap is a weekly view or daily view
but it has a variable inside a variable ( $select_wday$ is inside $week_or_day_view$)
example of search,

timechart span=5m max(globalStatActiveSubscribers) by device | $week_or_day_view$

The 2 dropdowns:

1/

<input type="dropdown" token="select_wday">
  <label>Select Day:</label>
  <choice value="Mon">Mon</choice>
  <choice value="Tue">Tue</choice>
  <choice value="Wed">Wed</choice>
  <choice value="Thu">Thu</choice>
  <choice value="Fri">Fri</choice>
  <choice value="Sat">Sat</choice>
  <choice value="Sun">Sun</choice>
  <default>$Date$</default>
</input>

2/

<input type="dropdown" token="week_or_day_view">
  <label>Week/Day View:</label>
  <choice value='eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
  <choice value="timewrap d series=exact">week</choice>
  <default>day</default>
</input>

Dropdown 1 works on its own, but when I introduce dropdown 2 it does not work.

Dropdown 2 works for choice2 but not for choice 1 becuase of the variable $select_wday$ inside that choice.

Maybe related:
https://answers.splunk.com/answers/558791/dropdown-based-on-another-dropdown.html?utm_source=typeahe...
https://answers.splunk.com/answers/233717/the-formatting-of-a-graph-is-not-holding-for-the-d.html?ut...
https://answers.splunk.com/answers/79678/dropdown-question.html?utm_source=typeahead&utm_medium=newq...
https://answers.splunk.com/answers/239138/how-do-i-make-a-dropdown-dynamic-based-on-a-feedse.html?ut...
https://answers.splunk.com/answers/235589/how-to-clear-dropdown-box.html?utm_source=typeahead&utm_me...
https://answers.splunk.com/answers/680173/how-can-i-retrieve-another-field-value-from-dashbo.html?ut...

0 Karma
1 Solution

niketn
Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HattrickNZ
Motivator

tks @niketnilay. that works and more tks for the cascade effect. Very Nice!

niketn
Legend

😄 Anytime... Glad you found this useful!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nareshinsvu
Builder

Can you rewrite your 2nd dropdown something like below and try?

My reply was somehow removing the correct formatting. So, I have removed "<" from each line below. Hope you get what I am trying to say.

"
input type="dropdown" token="week_or_day_view">
label>Week/Day View:
default>-
choice value="-">
initialValue>-
fieldForLabel>wday
fieldForValue>wday
search>
query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact
earliest>0
/search>
/input>
"

HattrickNZ
Motivator

tks, but I think I am only guessin, this is what I tried. I could get the code to look right but not sure if I can get it to work, or indeed if it can work. tks though. let me know if can explain it better.

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View2:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
    <choice value=' eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>

</input>

another:

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View3:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<search>
<query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact </query>
<earliest>0</earliest>
</search>
</input>
0 Karma

nareshinsvu
Builder

Can you share your full code? Below code will always run against current time and will not take you to other days. That's the reason it might not be working

eval wday = strftime(_time, "%a")

And below code will exclude wday from your output. So, you can't assign it to the token week_or_day_view

fields - wday

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...