Dashboards & Visualizations

Drilldown into a multiselect input

Explorer

Hi everyone,

I have a drilldown with the following values: "Fin", "Gar", "Mid", "Risc" and "Nuc" and when I select Fin (for example), the multiselect must show the following options: "LNR", "MTF" and "SLF", when you select "Gar", the multiselect must show 3 others options and so it goes.

Thanks in advance.

0 Karma

Path Finder

Hello,

this is working example:

  1. Multiselect Drilldown




    @d
    now




    Show All
    Show All

    index=_internal | stats count by sourcetype
    $dt.earliest$
    $dt.latest$

    sourcetype
    sourcetype
    (
    )
    sourcetype=
    OR


    Source Types




    index=your_index | search $sourcetypes$

    $dt.earliest$
    $dt.latest$

    10
    none
    row
    false
    true
    ["sourcetype","count"]


0 Karma

Legend

@nsantiago17 where is the drilldown coming from? Also from where will you get the correlation like FIN --> LNR, MTF, SLF etc? Can you add what is the code you currently have and what is not working for you?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Explorer

The drilldown comes from a table, I'm using the lookup command to load them to the search and the FIN is the index, the LNR, MTF and SLF are the values below the index.

FIN | GAR | ....

LNR ABC ....
MTF ACB ....
SLF BAC ....

0 Karma

Esteemed Legend

You are going to have to be more descriptive and clear. For example, your last sentence is the exact opposite of the description above it. It makes no sense.

0 Karma

Explorer

Thanks for the advice, I've edited the question.

0 Karma

Esteemed Legend

I am even more confused than before. Are you sure you said it the way that you meant it?

0 Karma