Cascading Dynamic dropdowns

[crispb]

Hello,

I am attempting to create a search that utilises two drop boxes.

The first dropdown is populated from a query which lists servers

  <label>Server List</label>
  <description>Projects the future disk usage of all/description>
  <fieldset autoRun="false" submitButton="true">
    <input type="dropdown" token="Host" searchWhenChanged="true">
      <label>Server Name</label>
      <fieldForLabel>Host</fieldForLabel>
      <fieldForValue>Host</fieldForValue>
      <search>
        <query>| inputlookup windows_hostmon_system | regex Host="regexgoeshere" | dedup Host</query>
      </search>
      <default>default server goes here</default>
      <initialValue>InitialServerName</initialValue>
    </input>

I then want to use the selection of the above dropdown and commit it to a token to be used in the next dropdown.

    <input type="dropdown" token="Disk">
      <label>Disk</label>
      <fieldForLabel>Disk</fieldForLabel>
      <fieldForValue>Name</fieldForValue>
      <search>
        <query>eventtype=hostmon_windows source=Disk host="$HostChoice$" sourcetype="Winhostmon" Name="*" | stats count(Name) by Name</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
    </input>

Is it possible to capture the output of a dynamic dropdown and use that output as a variable in other dynamic dropdowns.

Kind Regards

[gcusello · Accepted solution]

Hi @crispb,

yes you can:

the second dropdown is a search as the ones in panels, so you have to put the token in the input's search as if they were:

eventtype=hostmon_windows source=Disk host="$Host$" sourcetype="Winhostmon" Name="*" 
| stats count by Name

Ciao.

Giuseppe

[crispb]

Hello @gcusello 

Thanks for the response.

I honestly must of missed that I renamed the token.

Many hours of frustration fixed by a fresh set of eyes.

Thanks for the help.

Regards

[gcusello]

Hi @crispb,

no problem: it's an easy error 😉

The important thing is that you solved, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉