Dashboards & Visualizations

Dashboard Studio Dropdown: Set multiple tokens or set single token but display different values

ramuzzini
Path Finder

Working on a dashboard in dashboard studio to display data in two different tables using a single dropdown.  Issue I have is that all my data is determined by the "username" field but want to have dropdown display user Lastname, Firstname for better visibility.   

First table pulls records from a lookup table with user demographics and such.  Second table is pulling respective window log data tracking various user activity.  

In my dropdown, I am currently using the lookup table and eval function to join both "user_last", "user_first" set variable to "fullname" and display User "Lastname, Firstname".   I then used "fullname" as the pass-on token for my first table.   However, my second table, I need the "username" as the token because the data I am querying only has the "username" in the logs and not the users first or last name as my first table.   

My question is can I set my dropdown to display "user_last, user_first" names but set the token value as "username" or can I assign multiple tokens in a SPL query in Dashboard Studio to use in the respective tables or can I do both for sake of knowledge.  

Here is what I am working with and appreciate any assistance with this.


Lookup table:
     Name:    system_users.csv
     Fields:    username,    name_last,     name_first....

Dashboard Dropdown Field Values:
    Data Source Name:    lookup_users

SPL Query:

   

| inputlookup bpn_system_users.csv
    | eval fullname= name_last.", ".name_first
    | table fullname
    | sort fullname

Source Code:
  

 {
      "type": "ds.search",
      "options": {
          "queryParameters": {
              "earliest": "$SearchTimeLine.earliest$",
              "latest": "$SearchTimeLine.latest$"
            },
          "query": " | inputlookup system_users.csv\n
                              | eval fullname= name_last.\", \".name_first\n
                              | table fullname\n
                              | sort fullname"
        },
      "name": "lookup_users"
   }



Labels (3)
Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@ramuzzini- I'm not sure if it is feasible with Dashboard Studio. But it is possible to do with regular Splunk Simple XML (Classic) dashboard.

In Simple XML dashboard you can use <change> effect and use $value$ for username & $label$ to get full username.

Here is the reference which is similar to what you are looking for but in Simple XML dashboard - https://community.splunk.com/t5/Dashboards-Visualizations/How-to-set-two-tokens-off-one-dropdown-in-...

(Please take some time to review this and learn, I know if you don't have much experience with Simple XML Dashboard then it may take some time to understand it.)

 

I hope this helps!!! Kindly upvote if it does!!!

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...