Dashboards & Visualizations

Dashboard Studio: populate dropdown via datasource

bloodseaker
Explorer

Hi,

 

In the old dashboard scenario, we could easily, for a dropdown input field, enter the query that populates choices.

In dashboard studio, there isn't any documentation on it, so I tried an example I found, but it isn't working, and the properties used are also not found in the docs.

Idea behind is, that I want to select the application I want to see the dashboard for, but don't want to manually add a new application, rather have it found via a query from the logs.

Is this something that just can't be done? I would think it is a default thing you want for input dropdowns

 

 

{
    "options": {
        "items": [],
        "token": "ddlApplication"
    },
    "dataSources": {
        "primary": "ds_applications"
    },
    "encoding": {
        "label": "primary[0]",
        "value": "primary[0]"
    },
    "title": "Application",
    "type": "input.dropdown"
}

 

 

Labels (1)
1 Solution

bloodseaker
Explorer

Hi,

 

Just had another look and noticed something (which btw is annoying in that Dashboard Studio).

I gave my data source a name, and used that name in the datasource section above.

But, Splunk generates it own unique ID everything and that should be used instead of course. But there is no way of 'seeing that id' unless you scroll in the code.

With that adjustment, everything seems to work now.

View solution in original post

bloodseaker
Explorer

Hi,

 

Just had another look and noticed something (which btw is annoying in that Dashboard Studio).

I gave my data source a name, and used that name in the datasource section above.

But, Splunk generates it own unique ID everything and that should be used instead of course. But there is no way of 'seeing that id' unless you scroll in the code.

With that adjustment, everything seems to work now.

bloodseaker
Explorer

Hi,

 

Thanks for your response.

The query itself, ds_applications is returning a table of application names. So just a 1 column table, nothing Else.

It returns about 32 results, so not huge number either and runs below a second so efficiënt as well. No syntax errors in code are shown and I also tried with leaving the defaultValue in there, but it did not matter to the result

Maybe useful as well, we are running on Splunk Cloud, Version 8.2.2104.1 

0 Karma

Patrick_Peeters
Splunk Employee
Splunk Employee

The docs example for Dashboard Studio on docs.splunk.com seems to do exactly what you want, although I guess you found that as your code looks very much like it. They have a default value but you can remove that, as you have done in your code.

I tried it with success in my own environment a few days ago on 8.2.0, what is your search from ds_applications returning? With your code below both the value and label are the first result that come up (e.g. primary[0])

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...