Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

HattrickNZ
Motivator
‎07-16-2019 04:40 PM

TLDR;
I have 2 dropdowns, Can I pass the value/choice from 1 dropdown into the choice of another dropdown?

I have 2 dropdowns
1/ selects the day of the week and that then draws the gragh for that day
example of search, where $select_wday$ is the variable that would change from the dropdown: 

timechart span=5m max(globalStatActiveSubscribers) by device |
        eval wday = strftime(_time, "%a") |
        where wday = "$select_wday$" |
        fields - wday |
        timewrap d series=exact

2/ I want this to control whether timewrap is a weekly view or daily view
but it has a variable inside a variable ( $select_wday$ is inside $week_or_day_view$)
example of search, 

timechart span=5m max(globalStatActiveSubscribers) by device | $week_or_day_view$

The 2 dropdowns:

1/ 

<input type="dropdown" token="select_wday">
  <label>Select Day:</label>
  <choice value="Mon">Mon</choice>
  <choice value="Tue">Tue</choice>
  <choice value="Wed">Wed</choice>
  <choice value="Thu">Thu</choice>
  <choice value="Fri">Fri</choice>
  <choice value="Sat">Sat</choice>
  <choice value="Sun">Sun</choice>
  <default>$Date$</default>
</input>

2/ 

<input type="dropdown" token="week_or_day_view">
  <label>Week/Day View:</label>
  <choice value='eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>
  <choice value="timewrap d series=exact">week</choice>
  <default>day</default>
</input>

Dropdown 1 works on its own, but when I introduce dropdown 2 it does not work.

Dropdown 2 works for choice2 but not for choice 1 becuase of the variable $select_wday$ inside that choice.

Maybe related:
https://answers.splunk.com/answers/558791/dropdown-based-on-another-dropdown.html?utm_source=typeahe...
https://answers.splunk.com/answers/233717/the-formatting-of-a-graph-is-not-holding-for-the-d.html?ut...
https://answers.splunk.com/answers/79678/dropdown-question.html?utm_source=typeahead&utm_medium=newq...
https://answers.splunk.com/answers/239138/how-do-i-make-a-dropdown-dynamic-based-on-a-feedse.html?ut...
https://answers.splunk.com/answers/235589/how-to-clear-dropdown-box.html?utm_source=typeahead&utm_me...
https://answers.splunk.com/answers/680173/how-can-i-retrieve-another-field-value-from-dashbo.html?ut...

0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

niketn
Legend
‎07-16-2019 07:38 PM

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Reply
Solved! Jump to solution
Solution

niketn
Legend
‎07-16-2019 07:38 PM

@HattrickNZ try the following run anywhere example. I have used the <change> event handler for second dropdown to set the required tokens.

PS: I have added unset of second dropdown on change of first to create the cascaded change effect.

<form>
  <label>Linked Dropdown</label>
  <init>
    <eval token="Date">strftime(now(),"%a")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="dropdown" token="select_wday" searchWhenChanged="true">
      <label>Select Day:</label>
      <choice value="Mon">Mon</choice>
      <choice value="Tue">Tue</choice>
      <choice value="Wed">Wed</choice>
      <choice value="Thu">Thu</choice>
      <choice value="Fri">Fri</choice>
      <choice value="Sat">Sat</choice>
      <choice value="Sun">Sun</choice>
      <default>$Date$</default>
      <change>
        <unset token="form.ddWeekOrDayView"></unset>
      </change>
    </input>
    <input type="dropdown" token="ddWeekOrDayView" searchWhenChanged="true">
      <label>Week/Day View:</label>
      <choice value="day">day</choice>
      <choice value="week">week</choice>
      <default>day</default>
      <change>
        <condition value="day">
          <set token="week_or_day_view">eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact</set>
        </condition>
        <condition value="week">
          <set token="week_or_day_view">timewrap d series=exact</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>
          Date: $Date$
        </div>
        <div>
          select_wday: $select_wday$
        </div>
        <div>
          ddWeekOrDayView: $ddWeekOrDayView$
        </div>
        <div>
          week_or_day_view: $week_or_day_view$
        </div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Reply
Solved! Jump to solution

HattrickNZ
Motivator
‎07-17-2019 07:28 PM

tks @niketnilay. that works and more tks for the cascade effect. Very Nice!

Reply
Solved! Jump to solution

niketn
Legend
‎07-17-2019 10:59 PM

😄 Anytime... Glad you found this useful!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Reply
Solved! Jump to solution

nareshinsvu
Builder
‎07-16-2019 06:20 PM

Can you rewrite your 2nd dropdown something like below and try?

My reply was somehow removing the correct formatting. So, I have removed "<" from each line below. Hope you get what I am trying to say.

"
input type="dropdown" token="week_or_day_view">
label>Week/Day View:
default>-
choice value="-">
initialValue>-
fieldForLabel>wday
fieldForValue>wday
search>
query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact
earliest>0
/search>
/input>
"

Reply
Solved! Jump to solution

HattrickNZ
Motivator
‎07-17-2019 07:02 PM

tks, but I think I am only guessin, this is what I tried. I could get the code to look right but not sure if I can get it to work, or indeed if it can work. tks though. let me know if can explain it better.

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View2:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
    <choice value=' eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact'>day</choice>

</input>

another: 

    <input type="dropdown" token="week_or_day_view">
<label>Week/Day View3:</label>
<default>-</default>
<choice value="-">-</choice>
<initialValue>-</initialValue>-
<fieldForLabel>wday</fieldForLabel>
<fieldForValue>wday</fieldForValue>
<search>
<query>| makeresults | eval wday = strftime(_time, "%a") | where wday = "$select_wday$" | fields - wday | timewrap d series=exact </query>
<earliest>0</earliest>
</search>
</input>
0 Karma
Reply
Solved! Jump to solution

nareshinsvu
Builder
‎07-17-2019 07:12 PM

Can you share your full code? Below code will always run against current time and will not take you to other days. That's the reason it might not be working

eval wday = strftime(_time, "%a")

And below code will exclude wday from your output. So, you can't assign it to the token week_or_day_view

fields - wday

0 Karma
Reply
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...