Dashboards & Visualizations

Drilldown into a multiselect input

nsantiago17
Explorer

Hi everyone,

I have a drilldown with the following values: "Fin", "Gar", "Mid", "Risc" and "Nuc" and when I select Fin (for example), the multiselect must show the following options: "LNR", "MTF" and "SLF", when you select "Gar", the multiselect must show 3 others options and so it goes.

Thanks in advance.

0 Karma

Kawtar
Path Finder

Hello,

this is working example:

  1. Multiselect Drilldown




    @d
    now




    Show All
    Show All

    index=_internal | stats count by sourcetype
    $dt.earliest$
    $dt.latest$

    sourcetype
    sourcetype
    (
    )
    sourcetype=
    OR


    Source Types




    index=your_index | search $sourcetypes$

    $dt.earliest$
    $dt.latest$

    10
    none
    row
    false
    true
    ["sourcetype","count"]


0 Karma

niketn
Legend

@nsantiago17 where is the drilldown coming from? Also from where will you get the correlation like FIN --> LNR, MTF, SLF etc? Can you add what is the code you currently have and what is not working for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nsantiago17
Explorer

The drilldown comes from a table, I'm using the lookup command to load them to the search and the FIN is the index, the LNR, MTF and SLF are the values below the index.

FIN | GAR | ....

LNR ABC ....
MTF ACB ....
SLF BAC ....

0 Karma

woodcock
Esteemed Legend

You are going to have to be more descriptive and clear. For example, your last sentence is the exact opposite of the description above it. It makes no sense.

0 Karma

nsantiago17
Explorer

Thanks for the advice, I've edited the question.

0 Karma

woodcock
Esteemed Legend

I am even more confused than before. Are you sure you said it the way that you meant it?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...