Dashboards & Visualizations

2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

HattrickNZ
Motivator

TLDR;
I have 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

I have 2 dropdowns
1/ selects the day of the week and that then draws the gragh for that day
example of search, where $select_wday$ is the variable that would change from the dropdown:

timechart span=5m max(globalStatActiveSubscribers) by device |
        eval wday = strftime(_time, "%a") |
        where wday = "$select_wday$" |
        fields - wday |
        timewrap d series=exact

2/ I want this to control whether timewrap is a weekly view or daily view
but it has a variable inside a variable ( $select_wday$ is inside $week_or_day_view$)
example of search,

timechart span=5m max(globalStatActiveSubscribers) by device | $week_or_day_view$

The 2 dropdowns:

1/

<input type="dropdown" token="select_wday">
  <label>Select Day:</label>
  <choice value="Mon">Mon</choice>
  <choice value="Tue">Tue</choice>
  <choice value="Wed">Wed</choice>
  <choice value="Thu">Thu</choice>
  <choice value="Fri">Fri</choice>
  <choice value="Sat">Sat</choice>
  <choice value="Sun">Sun</choice>
  <default>$Date$</default>
</input>

2/

<input type="dropdown" token="week_or_day_view">
  <label>Week/Day View:</label>
  <choice value='eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
  <choice value="timewrap d series=exact">week</choice>
  <default>day</default>
</input>

Dropdown 1 works on its own, but when I introduce dropdown 2 it does not work.

Dropdown 2 works for choice2 but not for choice 1 becuase of the variable $select_wday$ inside that choice.

Maybe related:
https://answers.splunk.com/answers/558791/dropdown-based-on-another-dropdown.html?utm_source=typeahe...
https://answers.splunk.com/answers/233717/the-formatting-of-a-graph-is-not-holding-for-the-d.html?ut...
https://answers.splunk.com/answers/79678/dropdown-question.html?utm_source=typeahead&utm_medium=newq...
https://answers.splunk.com/answers/239138/how-do-i-make-a-dropdown-dynamic-based-on-a-feedse.html?ut...
https://answers.splunk.com/answers/235589/how-to-clear-dropdown-box.html?utm_source=typeahead&utm_me...
https://answers.splunk.com/answers/680173/how-can-i-retrieve-another-field-value-from-dashbo.html?ut...

0 Karma
1 Solution

niketn
Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

HattrickNZ
Motivator

tks @niketnilay. that works and more tks for the cascade effect. Very Nice!

niketn
Legend

😄 Anytime... Glad you found this useful!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nareshinsvu
Builder

Can you rewrite your 2nd dropdown something like below and try?

My reply was somehow removing the correct formatting. So, I have removed "<" from each line below. Hope you get what I am trying to say.

"
input type="dropdown" token="week_or_day_view">
label>Week/Day View:
default>-
choice value="-">
initialValue>-
fieldForLabel>wday
fieldForValue>wday
search>
query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact
earliest>0
/search>
/input>
"

HattrickNZ
Motivator

tks, but I think I am only guessin, this is what I tried. I could get the code to look right but not sure if I can get it to work, or indeed if it can work. tks though. let me know if can explain it better.

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View2:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
    <choice value=' eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>

</input>

another:

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View3:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<search>
<query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact </query>
<earliest>0</earliest>
</search>
</input>
0 Karma

nareshinsvu
Builder

Can you share your full code? Below code will always run against current time and will not take you to other days. That's the reason it might not be working

eval wday = strftime(_time, "%a")

And below code will exclude wday from your output. So, you can't assign it to the token week_or_day_view

fields - wday

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...