Building a view with 3 dynamically filling drop down menus

[pl123]

Hi I am fairly new to this sort of thing, I am trying to build a view that has 3 Dropdown menus that populate themselves from the selections made in the previous drop downs.

For example The first dropdown lists "domains" (which would ideally be prepopulated from a file), the second drop down then lists all the clusters in the selected domain, and then the third drop down shows all the servers in the cluster selected in the second drop down.

The selected server in the third drop down then populates a eventViewer below with recent events.

Is this possible to do this in simpleXML? or would advancedXML be better?

My current code is below, it doesnt really do much as I cant figure out how to link up the drop downs to create a master search 🙂

    <form>
<label>Server Selecter Test</label>
<searchTemplate>$domain$</searchTemplate>
<fieldset>
    <input type="dropdown" token="domain">
        <label>wl_domain</label>
        <populatingSearch fieldForValue="wl_domain" fieldForLabel="wl_domain" earliest="-2h"><![CDATA[host="*" | top  wl_server limit=10]]></populatingSearch>
        <default>*</default>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<label>Search Form Test</label>
<searchTemplate>$cluster$</searchTemplate>
<fieldset>
    <input type="dropdown" token="cluster">
        <label>wl_cluster</label>
        <populatingSearch fieldForValue="wl_cluster" fieldForLabel="wl_cluster" earliest="-1h"> <![CDATA[host="*" | top  wl_cluster limit=10]]></populatingSearch>
        <default>*</default>
        <choice value="*">Any</choice>
    </input>
</fieldset>

<label>Search Form Test</label>
<searchTemplate>$server$</searchTemplate>
<fieldset>
    <input type="dropdown" token="server">
        <label>wl_server</label>
        <populatingSearch fieldForValue="wl_server" fieldForLabel="wl_server" earliest="-1h"> <![CDATA[host="*" | top  wl_server limit=10]]></populatingSearch>
        <default>*</default>
        <choice value="*">Any</choice>
    </input>
</fieldset>
 <row>
   <table>
    <title>Selected Event Info</title>
     <option name="blah">true</option>
    </table>
  </row>
</form>

[sideview · Accepted solution]

It's not possible in the Simple XML, no. You'll have to switch to the Advanced XML, but it's not that bad.

1) Download the "UI Examples for 4.1" app from splunkbase. (Go to App > Launcher > Browse other apps > "UI Examples for 4.1" > Install)

2) Go to the UI Examples app which will now be in your splunk instance

3) Go to "Advanced XML > Intro".

4) While you're reading this, have the XML source of that same view open in a text editor nearby. The easiest way is to paste the XML out of the relevant manager page. (Manager > User interface > Views > advanced_intro1)

(Note: do not use the ?showsource=1 trick because that will strip the comments out of the XML and in this case there are many valuable comments.)

5) After that read the second advanced XML page carefully, and read through the XML source as you're doing so.

6) At this point you could skip ahead if you wanted to and the config you need to learn about is in "Advanced XML > Lister Examples > 2 Listers driving multiple elements".

It's a little tricky. I wont lie. But what you want to do can totally be done and I've certainly done it.

[pl123]

Cheers, figured out advanced xml, searchlinkLister, convertToIntention's etc and got it working in a couple of hundred lines. thanks again.

[pl123]

Thanks mate, will have a look at this again over the weekend.