Dashboards & Visualizations

Change query dynamically based on dashboard

karthi25
Path Finder

I am having dropdown with values as below:

ec count
dc count
fc count 

Now I want to draw a line chart from this dropdown input. My Query may entirely different for each dropdown input, So I want to change the line chart query based on the dropdown input.
Kindly help me out to do it.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi karthi25,
insert the query parts in each value of your choice and then use token in your searches.
in other words something like this

<form>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="radio" token="option">
      <label>Option</label>
      <choice value="| stats count BY host">Option 1</choice>
      <choice value="| stats dc(host)">Option 2</choice>
      <choice value="| stats count">Option 3</choice>
      <initialValue>| stats count BY host</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $option$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

You can put in each token also the full search.

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...