Based on the example given, I think the OP wants to adapt dropdowns to actual deployed application and environment combination dynamically. So, I'd take a different route. The key is the composition of index names. I think what you want is like
- For environment token
| tstats count by index
| rex field=index "[^_]+_(?<environment>.+)"
| stats count by environment
| fields - count- for application token
| tstats count by index
| rex field=index "(?<application>[^_]+)_"
| stats count by application
| fields - countHere is a complete mockup dashboard:
<form version="1.1" theme="light">
<label>multiple dependent dropdown Dashboard</label>
<description>https://community.splunk.com/t5/Dashboards-Visualizations/Create-multiple-dependent-dropdown-Dashboard/m-p/758134#M59378</description>
<fieldset submitButton="false">
<input type="dropdown" token="environment_tok">
<label>Environment</label>
<fieldForLabel>environment</fieldForLabel>
<fieldForValue>environment</fieldForValue>
<search>
<query>| makeresults
| eval environment = split("stage,test,prod", ","), application = mvappend("s1", "s2", "s3")
| mvexpand environment
| mvexpand application
| eval index = application . "_" . environment
| stats count by index
``` the above emulates
| tstats count by index ```
| rex field=index "\S+_(?<environment>.+)"
| stats count by environment
| fields - count</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
<input type="dropdown" token="application_tok">
<label>Application</label>
<fieldForLabel>application</fieldForLabel>
<fieldForValue>application</fieldForValue>
<search>
<query>| makeresults
| eval environment = split("stage,test,prod", ","), application = mvappend("s1", "s2", "s3")
| mvexpand environment
| mvexpand application
| eval index = application . "_" . environment
| stats count by index
``` the above emulates
| tstats count by index ```
| rex field=index "(?<application>[^_]+)_"
| stats count by application
| fields - count
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
</input>
</fieldset>
<row>
<panel>
<title>This is what you put in your search</title>
<html>
<pre>
index="$application_tok$_$environment_tok$"
blah, blah
</pre>
</html>
</panel>
<panel>
<title>This is what your search renders into</title>
<html>
<pre>
index="$application_tok$_$environment_tok$"
blah, blah
</pre>
</html>
</panel>
</row>
<row>
<panel>
<title>Use this search for environment</title>
<html>
<pre>
| tstats count by index
| rex field=index "[^_]+_(?<environment>.+)"
| stats count by environment
| fields - count
</pre>
</html>
</panel>
<panel>
<title>Use this search for application</title>
<html>
<pre>
| tstats count by index
| rex field=index "(?<application>[^_]+)_"
| stats count by application
| fields - count
</pre>
</html>
</panel>
</row>
</form>This way, no matter what combination of deployment is, the dropdowns always have the correct elements.
