Hi, I am wondering how to add a drop-down list in a dashboard/form.
The situation is the following: I have a bunch of queries that I would like to run against a specific customer. Let's say that I have: {Customer1, Customer2, Customer3,...Customer n} and the queries:
- Query 1: ... | search customerName="Customer1";
- Query 2: ... | search customerName="Customer1";
- ....
- Query m: ... | search customerName="Customer1";
I would like these queries to run against the CustomerX selected from the drop-down list {Customer1, Customer2, Customer3,...Customer n}
Is possible to get this done using Splunk? Any help will be more than welcome.
I'm using Splunk 6.0
Many thanks.
I managed to get a solution for my own question 🙂
The code that is required is the following using Simple XML:
<form>
<fieldset>
<input type="dropdown" token="customer">
<default>Alaska </default>
<label>Select a Customer name: </label>
<populatingSearch fieldForValue="customerName" fieldForLabel="customerName">
<![CDATA[eventtype=xxx | stats count by customerName]]>
</populatingSearch>
</input>
</fieldset>
<row>
<table>
<title>Function Usage </title>
<searchString>eventtype=xxx| search customerName="$customer$" | yyy </searchString>
<option name="wrap">true </option>
<option name="rowNumbers">false </option>
<option name="dataOverlayMode">none </option>
<option name="drilldown">row </option>
<option name="count">10 </option>
</table>
</row>
</form>
Notes: