Working on a dashboard in dashboard studio to display data in two different tables using a single dropdown. Issue I have is that all my data is determined by the "username" field but want to have dropdown display user Lastname, Firstname for better visibility.
First table pulls records from a lookup table with user demographics and such. Second table is pulling respective window log data tracking various user activity.
In my dropdown, I am currently using the lookup table and eval function to join both "user_last", "user_first" set variable to "fullname" and display User "Lastname, Firstname". I then used "fullname" as the pass-on token for my first table. However, my second table, I need the "username" as the token because the data I am querying only has the "username" in the logs and not the users first or last name as my first table.
My question is can I set my dropdown to display "user_last, user_first" names but set the token value as "username" or can I assign multiple tokens in a SPL query in Dashboard Studio to use in the respective tables or can I do both for sake of knowledge.
Here is what I am working with and appreciate any assistance with this.
Lookup table:
Name: system_users.csv
Fields: username, name_last, name_first....
Dashboard Dropdown Field Values:
Data Source Name: lookup_users
SPL Query:
| inputlookup bpn_system_users.csv
| eval fullname= name_last.", ".name_first
| table fullname
| sort fullname
Source Code:
{
"type": "ds.search",
"options": {
"queryParameters": {
"earliest": "$SearchTimeLine.earliest$",
"latest": "$SearchTimeLine.latest$"
},
"query": " | inputlookup system_users.csv\n
| eval fullname= name_last.\", \".name_first\n
| table fullname\n
| sort fullname"
},
"name": "lookup_users"
}
@ramuzzini- I'm not sure if it is feasible with Dashboard Studio. But it is possible to do with regular Splunk Simple XML (Classic) dashboard.
In Simple XML dashboard you can use <change> effect and use $value$ for username & $label$ to get full username.
Here is the reference which is similar to what you are looking for but in Simple XML dashboard - https://community.splunk.com/t5/Dashboards-Visualizations/How-to-set-two-tokens-off-one-dropdown-in-...
(Please take some time to review this and learn, I know if you don't have much experience with Simple XML Dashboard then it may take some time to understand it.)
I hope this helps!!! Kindly upvote if it does!!!