Dashboards & Visualizations

Can you help me with my dropdown list show?

SoknySplunk
New Member

I have two dropdown list related to each other.
- Dropdown_list 1= red, yellow, orange, blue…
- Dropdown_list 1= user_a, user_b, user_c, user_d
When I choose a colour in dropdown_list_1, I want dropdown_list_2 to show default all user who love that colour. ALL. Thanks your help.

0 Karma
1 Solution

harishalipaka
Builder

hi @SoknySplunk

try this code..

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="colour">
      <label>colour</label>
      <fieldForLabel>colour</fieldForLabel>
      <fieldForValue>colour</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="user">
      <label>user</label>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time |where colour="$colour$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

View solution in original post

0 Karma

harishalipaka
Builder

hi @SoknySplunk

try this code..

<form>
  <label>dropdown</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="colour">
      <label>colour</label>
      <fieldForLabel>colour</fieldForLabel>
      <fieldForValue>colour</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="dropdown" token="user">
      <label>user</label>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
      <search>
        <query>|makeresults |eval colour="red" ,user="user1" |append[|makeresults |eval colour="yellow" ,user="user2"] |append[|makeresults |eval colour="orange" ,user="user3"] |fields - _time |where colour="$colour$"</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
</form>

View solution in original post

0 Karma

SoknySplunk
New Member

For example:
Field_color Field_user
red user_a
yellow user_b
orange user_c
blue user_d

If I choose blue in field_color, it should be show user_d only one in field_user
if i choose orange it should be show user_c only one in field_user

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

@SoknySplunk

Did you try @harishalipaka 's example? if it worked for you, please approve his answer. If not, go ahead and give us some more information so other community members know you still need help.

Thanks and happy Splunking!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@SoknySplunk

How are you relating RED and user_a? Can you please provide more information regarding who love red color and who love yellow?

0 Karma

SoknySplunk
New Member

user_a like all color
user-b like red color
user_c like yellow and orange
user_d like blue.
thanks

0 Karma

niketnilay
Legend

@SoknySplunk based on the requirement seems like you should setup a lookup file with Color to User mapping so that it becomes easy to maintain and correlate.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.