Dashboards & Visualizations

Dashboard multiple lookup filters

mwdbhyat
Builder

Hi there,

I am trying to create a dashboard with some filters..

Roughly:
3 boxes populated and filtered by a lookup or kvstore lookup

cat (car manufacturer) - for instance could be car manufacturer ( lets say i chose mercedes)
subcat (type) - petrol/diesel/electric (i choose a petrol filter)
result (cars listed assoicated with above filters) - (it lists car models from merc that are petrol)

but then maybe i wanna go back and have 2 types of filters so i would then go back to "subcat" and choose both "petrol and electric"
the result would then list both types filtered into to "result"

how can i accomplish this?

Thanks!

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mwdbhyat,
youhave to create three inputs in cascade, in other words:

  • the first input (car manufactures) is indipendent,
  • the second one (type) depends on first input,
  • the third one depends on both the others.

then in the panels search you put all the three inputs.
Probably for first and third inputs you can use a dropdown list, instead for the second you have to use a multichoice, something like this:

<fieldset submitButton="false">
    <input type="dropdown" token="input1">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="multiselect" token="input2">
      <label>Input2</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal $input1$ | dedup component | sort component | table component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>component="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
    <input type="dropdown" token="input3">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>field3</fieldForLabel>
      <fieldForValue>field3</fieldForValue>
      <search>
        <query>index=_internal $input1$ $input2$| dedup field3 | sort field3 | table field3</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>field3="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>-1d@d</earliest>
        <latest>@d</latest>
      </default>
    </input>
  </fieldset>.

Then in the panel's searches use the three tokens.

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mwdbhyat,
youhave to create three inputs in cascade, in other words:

  • the first input (car manufactures) is indipendent,
  • the second one (type) depends on first input,
  • the third one depends on both the others.

then in the panels search you put all the three inputs.
Probably for first and third inputs you can use a dropdown list, instead for the second you have to use a multichoice, something like this:

<fieldset submitButton="false">
    <input type="dropdown" token="input1">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal | dedup sourcetype | sort sourcetype | table sourcetype</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>sourcetype="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="multiselect" token="input2">
      <label>Input2</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal $input1$ | dedup component | sort component | table component</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <valuePrefix>component="</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <delimiter> OR </delimiter>
    </input>
    <input type="dropdown" token="input3">
      <label>Input1</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>field3</fieldForLabel>
      <fieldForValue>field3</fieldForValue>
      <search>
        <query>index=_internal $input1$ $input2$| dedup field3 | sort field3 | table field3</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <prefix>field3="</prefix>
      <suffix>"</suffix>
    </input>
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>-1d@d</earliest>
        <latest>@d</latest>
      </default>
    </input>
  </fieldset>.

Then in the panel's searches use the three tokens.

Ciao.
Giuseppe

0 Karma

mwdbhyat
Builder

Thanks that works

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...