Drop down box to populate a search with multiple values

[DonDandrea]

I need to create a dropdown box that provides multiple values for a single selection and I'm not sure how to go about it.

My search is listed below. You can see that there are two variables. When the $BROKNAM$ is selected from a dropdown there are six options. Four of those options are nonproduction lower environments. There are two values that can be selected that are production environments. In my graph I need to display the alert threshold value. That value is 4 in nonproduction environments and 5 in production environments. So, how can I get the dropdown to provide the broker name and the Danger value at the same time?

index=mainframe sourcetype=brkbyexe BrokerName=$BROKNAM$ ExecutionGroup=$EXECGRP$ | eval AboveTheBar=(StorageAboveTheBar/1024/1024/1024) | eval Danger=5 | timechart span=15M max(AboveTheBar) max(Danger)

Any help you can offer is greatly appreciated.

Thank you,
Donald

[MuS]

Hi DonDandrea,

take a look at the docs about Static and dynamic inputs to forms, think of the drop down to be your $BROKNAM$ and the radio buttons to be your Danger value you can set.

hope this helps to get you started ...

cheers, MuS

[MuS]

well did you know that you can pass something like this to the underlaying search as well:

BrokerName=Foo | eval myDanger="5" and pass this to the search as $BROKNAM$ like this:

index=mainframe sourcetype=brkbyexe $BROKNAM$ ...

[DonDandrea]

I was really hoping to eliminate the aditional input. They already have three. My latest idea to accomplish this is by using sa lookup. I'm new to Splunk so it will take some studying but I think that is the way to go.