Dashboards & Visualizations

Different query execution in Dashboard studio panel on the basis of drop down value.

Abhineet
Loves-to-Learn Everything

Hi

I want to execute different SPL query in Dashboard studio panel on the basis of dropdown value.

Drop down have two item only, if we select "Item1" in dropdown then in particular panel of Dashboard should execute "Query1" if selected "item2" in dropdown then in same panel of Dashboard studio should execute "Query2"

item1 = "Aruba NetWorks"

Item2 = "Cisco"

Query1 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| | eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table  node_dns node_ip region

Query2 = index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search node = $<dropdown token>$ | table  Name

Kindly Guide.

Thanks

Abhineet Kumar

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try setting the value of the dropdowns to be the parts of the search which are different

label1 as Aruba NetWorks, value1 as node = "Aruba NetWorks"| table  node_dns node_ip region

label2 as Cisco, value2 as node = "Cisco"| table  Name

Then change your search to use the token like this

index=dot1x_index sourcetype=cisco_failed_src OR sourcetype=aruba_failed_src| eval node= if(isnotnull(node_vendor),"Cisco","Aruba NetWorks")| search $<dropdown token>$

0 Karma

Abhineet
Loves-to-Learn Everything

Hi Thanks for reply

We can't make changes to dropdown as dropdown fields populates from SPL query and it's uses by other panel in dashboard.

need assistance to make changes in panel SPL query itself so it pick query on the basis of dropdown field.

other if you could help me to makes changes in json code to manage both SPL query according to dropdown menu.

Thanks

Abhineet Kumar 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure it is possible with Dashboard Studio (which I assume you are using since you mentioned JSON). With Classic / SimpleXML dashboards, you can use a change handler on the dropdown to set additional tokens based on the choice made.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...