Dashboards & Visualizations

Drilldown into a multiselect input

nsantiago17
Explorer

Hi everyone,

I have a drilldown with the following values: "Fin", "Gar", "Mid", "Risc" and "Nuc" and when I select Fin (for example), the multiselect must show the following options: "LNR", "MTF" and "SLF", when you select "Gar", the multiselect must show 3 others options and so it goes.

Thanks in advance.

0 Karma

Kawtar
Path Finder

Hello,

this is working example:

  1. Multiselect Drilldown




    @d
    now




    Show All
    Show All

    index=_internal | stats count by sourcetype
    $dt.earliest$
    $dt.latest$

    sourcetype
    sourcetype
    (
    )
    sourcetype=
    OR


    Source Types




    index=your_index | search $sourcetypes$

    $dt.earliest$
    $dt.latest$

    10
    none
    row
    false
    true
    ["sourcetype","count"]


0 Karma

niketn
Legend

@nsantiago17 where is the drilldown coming from? Also from where will you get the correlation like FIN --> LNR, MTF, SLF etc? Can you add what is the code you currently have and what is not working for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nsantiago17
Explorer

The drilldown comes from a table, I'm using the lookup command to load them to the search and the FIN is the index, the LNR, MTF and SLF are the values below the index.

FIN | GAR | ....

LNR ABC ....
MTF ACB ....
SLF BAC ....

0 Karma

woodcock
Esteemed Legend

You are going to have to be more descriptive and clear. For example, your last sentence is the exact opposite of the description above it. It makes no sense.

0 Karma

nsantiago17
Explorer

Thanks for the advice, I've edited the question.

0 Karma

woodcock
Esteemed Legend

I am even more confused than before. Are you sure you said it the way that you meant it?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...