Dashboards & Visualizations
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Add items in dropdown with fieldForValue

antonio147
Communicator
‎04-20-2021 01:54 AM

Hi,
I created a filter with all the months taken from the "SCOPE" field.
this contains 12 months back, in the dashboard I can have all the months written in Italian.
Now I would like the default to be the month prior to today.
I tried with
<default> $ A_data $ </default>
<choice value = "$ A_data $"> PREVIOUS_MONTH </choice>
but it does not work.
I would like it to be selected by Default (if today we are in April, "MARCH-2021" was selected)
Tks
Bye
Antonio

------ source -------

<form hideFilters="true">

  <label> Results and Details: Web survey</label>

  <fieldset submitButton="false">

    <input type="dropdown" token="field1">

      <label>Mese</label>

      <fieldForLabel>field1</fieldForLabel>

      <fieldForValue>AMBITO</fieldForValue>

      <search>

        <query>index=aladin * sourcetype=cruscotto_tnps

|search ZONA ="Totale"

|eval anno=mvindex(split(AMBITO,"-"),1)

|eval mese=mvindex(split(AMBITO,"-"),0)

| eval mesi=case(

mese="Gennaio","01",

mese="Febbraio","02",

mese="Marzo","03",

mese="Aprile","04",

mese="Maggio","05",

mese="Giugno","06",

mese="Luglio","07",

mese="Agosto","08",

mese="Settembre","09",

mese="Ottobre","10",

mese="Novembre","11",

mese="Dicembre","12",

1=1, "INV")

|eval OrdineAmbito = anno.mesi

|sort OrdineAmbito

| eval A_mese=strftime(relative_time(now(), "-30d@d"),"%m")

| eval A_anno=strftime(relative_time(now(), "-30d@d"),"%Y")

| eval A_mesi=case(

A_mese="01","Gennaio",

A_mese="02","Febbraio",

A_mese="03","Marzo",

A_mese="04","Aprile",

A_mese="05","Maggio",

A_mese="06","Giugno",

A_mese="07","Luglio",

A_mese="08","Agosto",

A_mese="09","Settembre",

A_mese="10","Ottobre",

A_mese="11","Novembre",

A_mese="12","Dicembre",

1=1, "INV")

|eval A_data= A_mesi."-".A_anno

 

|table AMBITO,A_data</query>

        <earliest>@d</earliest>

        <latest>now</latest>

      </search>

      <default>$A_data$</default>

      <choice value="$A_data$">MESE_PRECEDENTE</choice>

    </input>

  </fieldset>

  <row>

    <panel>

      <html>

        <div style="height: 2em;   display: flex;   align-items: center;   justify-content: center;color:blue;font-style:bold;font-size:200%">

         <B> $field1$</B>

        </div>

        </html>

    </panel>

  </row>

  <row>

    <panel>

      <html>

  

  </html>

    </panel>

  </row>

  <row>

    <panel>

      <single>

        <title>T-PRO</title>

        <search>

          <query>index=aladin * sourcetype=cruscotto_tnps

|search ZONA ="Totale"

|eval anno = strftime(_time,"%Y")

| eval mesi=strftime(_time,"%m")

| eval mese=case(

mesi="01","Gennaio-",

mesi="02","Febbraio-",

mesi="03","Marzo-",

mesi="04","Aprile-",

mesi="05","Maggio-",

mesi="06","giugno-",

mesi="07","Luglio-",

mesi="08","Agosto-",

mesi="09","Settembre-",

mesi="10","Ottobre-",

mesi="11","Novembre",

mesi="12","Dicembre-",

1=1, "INV")

|eval meseanno= mese.anno

|where AMBITO = "$field1$"

|sort ZONA

 

|fields T_PRO

|stats values(T_PRO)</query>

          <earliest>@d</earliest>

          <latest>now</latest>

        </search>

        <option name="drilldown">none</option>

        <option name="height">50</option>

        <option name="rangeColors">["0x006d9c","0x53a051"]</option>

        <option name="rangeValues">[500]</option>

        <option name="refresh.display">none</option>

        <option name="useColors">1</option>

      </single>

    </panel>

Labels (2)
Labels
Tags (2)
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎04-20-2021 02:54 AM

The fieldForLabel and fieldForValue elements are the names of fields from your search query - your search query might return multiple rows for the same month depending on your data. Your could try something like this

    <input type="dropdown" token="month">
      <label>Past 12 months</label>
      <search>
        <query>| makeresults
| eval month=mvrange(1, 13)
| mvexpand month
| eval month=0-month
| eval _time=relative_time(_time,month."mon@mon")
| eval AMBITO=strftime(_time,"%Y-%m")
| eval mesi=strftime(_time,"%m")
| eval A_data=case(mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-").strftime(_time,"%Y")
| table AMBITO A_data|</query>
        <done>
          <set token="default">$results.AMBITO$</set>
        </done>
      </search>
      <fieldForLabel>A_data</fieldForLabel>
      <fieldForValue>AMBITO</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>

View solution in original post

Reply
Solved! Jump to solution
Solution

ITWhisperer
SplunkTrust
SplunkTrust
‎04-20-2021 02:54 AM

The fieldForLabel and fieldForValue elements are the names of fields from your search query - your search query might return multiple rows for the same month depending on your data. Your could try something like this

    <input type="dropdown" token="month">
      <label>Past 12 months</label>
      <search>
        <query>| makeresults
| eval month=mvrange(1, 13)
| mvexpand month
| eval month=0-month
| eval _time=relative_time(_time,month."mon@mon")
| eval AMBITO=strftime(_time,"%Y-%m")
| eval mesi=strftime(_time,"%m")
| eval A_data=case(mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-").strftime(_time,"%Y")
| table AMBITO A_data|</query>
        <done>
          <set token="default">$results.AMBITO$</set>
        </done>
      </search>
      <fieldForLabel>A_data</fieldForLabel>
      <fieldForValue>AMBITO</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
Reply
Solved! Jump to solution

antonio147
Communicator
‎04-20-2021 03:32 AM

Excellent !!!
It works perfectly and even the months are sorted from largest to smallest.
I had ordered with YEAR-MONTH to have 2021-04,2021-03, etc ...... but this is better.
In addition, SCOPE contains the values of the 12 months prior to today for which from April-2021 to April-2020.
Actually I don't need A_data, I just need SCOPE, to query the charts.

now I have to see what you did to understand the concept well


thank you very much, you were really great !!!
Bye
Antonio

0 Karma
Reply
Solved! Jump to solution

antonio147
Communicator
‎04-20-2021 03:15 AM

I only need this queru to transform the values of the SCOPE field in Italian language:
Ottobre-2020
Novembre-2020
.
.
Febbraio-2021
Marzo-2021
Aprile-2021

There are no other data, I then take the data in the chart query where I use the $ filed1 $ variable obtained from the chosen month.
I want it to be the month before today by default.
I'll try your suggestion right away and let you know how it went 🙂
Tks
Bye
Antonio

0 Karma
Reply
Solved! Jump to solution

ITWhisperer
SplunkTrust
SplunkTrust
‎04-20-2021 02:02 PM

 

 

    <input type="dropdown" token="field1">
      <label>Mese</label>
      <fieldForLabel>A_data</fieldForLabel>
      <fieldForValue>AMBITO</fieldForValue>
      <search>
        <query>index=idx sourcetype=source
|search ZONA ="Totale"
|eval anno=mvindex(split(AMBITO,"-"),1)
|eval mese=mvindex(split(AMBITO,"-"),0)
| eval mesi=case(
mese="Gennaio","01",
mese="Febbraio","02",
mese="Marzo","03",
mese="Aprile","04",
mese="Maggio","05",
mese="Giugno","06",
mese="Luglio","07",
mese="Agosto","08",
mese="Settembre","09",
mese="Ottobre","10",
mese="Novembre","11",
mese="Dicembre","12",
1=1, "INV")
|eval OrdineAmbito = anno.mesi
|sort - OrdineAmbito
|eval A_data= mese."-".anno
| append [| makeresults
| eval A_data="MESE_PRECEDENTE"]
| streamstats count as row
| eventstats values(eval(if(row=2,AMBITO,null))) as second
| eval AMBIIO=if(A_data="MESE_PRECEDENTE",second." ",AMBITO)
| table AMBITO A_data second</query>
        <done>
          <set token="default">$result.second$</set>
        </done>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <default>$default$</default>
    </input>

 

 

When the field1 token is used, it should be trimmed due to the extra space added to avoid duplication of values.

Reply
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...