Dashboards & Visualizations

Can you help me with my dropdown list show?

SoknySplunk
Loves-to-Learn Lots

I have two dropdown list related to each other.
- Dropdown_list 1= red, yellow, orange, blue…
- Dropdown_list 1= user_a, user_b, user_c, user_d
When I choose a colour in dropdown_list_1, I want dropdown_list_2 to show default all user who love that colour. ALL. Thanks your help.

0 Karma
1 Solution

harishalipaka
Motivator

hi @SoknySplunk

try this code..

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="colour">
      <label>colour</label>
      <fieldForLabel>colour</fieldForLabel>
      <fieldForValue>colour</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="user">
      <label>user</label>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time |where colour="$colour$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

hi @SoknySplunk

try this code..

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="colour">
      <label>colour</label>
      <fieldForLabel>colour</fieldForLabel>
      <fieldForValue>colour</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="user">
      <label>user</label>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time |where colour="$colour$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>
Thanks
Harish
0 Karma

SoknySplunk
Loves-to-Learn Lots

For example:
Field_color Field_user
red user_a
yellow user_b
orange user_c
blue user_d

If I choose blue in field_color, it should be show user_d only one in field_user
if i choose orange it should be show user_c only one in field_user

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

@SoknySplunk

Did you try @harishalipaka 's example? if it worked for you, please approve his answer. If not, go ahead and give us some more information so other community members know you still need help.

Thanks and happy Splunking!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SoknySplunk

How are you relating RED and user_a? Can you please provide more information regarding who love red color and who love yellow?

0 Karma

SoknySplunk
Loves-to-Learn Lots

user_a like all color
user-b like red color
user_c like yellow and orange
user_d like blue.
thanks

0 Karma

niketn
Legend

@SoknySplunk based on the requirement seems like you should setup a lookup file with Color to User mapping so that it becomes easy to maintain and correlate.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...