Dropdown filter in Splunk dashboard studio

[saichandjawari]

I have below combo for region/environment

	Cluster	Space	Region
1	useast01	abs-qpp1	QAEAST
2	uswest01	abs-qpp1	QAWEST
3	usqaf01	abs-qff	QAF

1) If Cluster is useast01 and space is abs-qpp1 then the region is USEAST
2) If the cluster is uswest01 and space is abs-qpp1 then the region is USWEST
3) If the cluster is usqaf01 and space is abs-qff then the region is USQAF

I would like to have a single dropdown filter for Region (USEAST, USWEST, USQAF) with dynamic label select option for the above combos.


Request if someone provides a solution or an approach o

[livehybrid]

Hi @saichandjawari 

Have a look at the example below, I have included the dashboard config further down.

I am using the original cluster dropdown value with a query (called myvar) displayed as a table (hidden out of view) and then using $myvar:result.<field>$ where we need to use the value.

{
    "title": "Answers - testing",
    "description": "",
    "inputs": {
        "input_mwKjgBTB": {
            "options": {
                "items": [
                    {
                        "label": "useast01",
                        "value": "useast01"
                    },
                    {
                        "label": "uswest01",
                        "value": "uswest01"
                    },
                    {
                        "label": "usqaf01",
                        "value": "usqaf01"
                    }
                ],
                "selectFirstSearchResult": true,
                "token": "cluster"
            },
            "title": "Cluster",
            "type": "input.dropdown"
        }
    },
    "defaults": {
        "dataSources": {
            "ds.search": {
                "options": {
                    "queryParameters": {
                        "earliest": "$global_time.earliest$",
                        "latest": "$global_time.latest$"
                    }
                }
            }
        }
    },
    "visualizations": {
        "viz_2uQp06o5": {
            "dataSources": {
                "primary": "ds_c8AfQapt"
            },
            "type": "splunk.table"
        },
        "viz_JQgp3c9c": {
            "containerOptions": {},
            "dataSources": {
                "primary": "ds_eGOCKAoM_ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "key": "name",
                                "token": "method"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                }
            ],
            "options": {
                "majorValue": "> sparklineValues | lastPoint()",
                "trendValue": "> sparklineValues | delta(-2)"
            },
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "Cluster",
            "type": "splunk.singlevalue"
        },
        "viz_bxuHwYLl": {
            "containerOptions": {},
            "dataSources": {
                "primary": "ds_FKvGrvZ4_ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "key": "name",
                                "token": "method"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                }
            ],
            "options": {
                "majorValue": "> sparklineValues | lastPoint()",
                "trendValue": "> sparklineValues | delta(-2)"
            },
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "Space",
            "type": "splunk.singlevalue"
        },
        "viz_column_chart": {
            "containerOptions": {},
            "dataSources": {
                "primary": "ds_qBGlESX2"
            },
            "eventHandlers": [
                {
                    "options": {
                        "tokens": [
                            {
                                "key": "name",
                                "token": "method"
                            }
                        ]
                    },
                    "type": "drilldown.setToken"
                }
            ],
            "options": {
                "majorValue": "> sparklineValues | lastPoint()",
                "trendValue": "> sparklineValues | delta(-2)"
            },
            "showLastUpdated": false,
            "showProgressBar": false,
            "title": "Region",
            "type": "splunk.singlevalue"
        }
    },
    "dataSources": {
        "ds_FKvGrvZ4_ds_qBGlESX2": {
            "name": "get_space",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval space=\"$myvars:result.space$\""
            },
            "type": "ds.search"
        },
        "ds_c8AfQapt": {
            "name": "myvars",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval cluster=\"$cluster$\"\n| eval space=CASE(cluster==\"usqaf01\", \"abs-qff\", cluster==\"uswest01\",\"abs-qpp1\",cluster==\"useast01\",\"abs-qpp1\")\n| eval region=CASE(cluster==\"usqaf01\", \"QAF\", cluster==\"uswest01\",\"QAWEST\",cluster==\"useast01\",\"QAEAST\")",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "type": "ds.search"
        },
        "ds_eGOCKAoM_ds_qBGlESX2": {
            "name": "get_cluster",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval cluster=\"$myvars:result.cluster$\""
            },
            "type": "ds.search"
        },
        "ds_qBGlESX2": {
            "name": "Search_1",
            "options": {
                "enableSmartSources": true,
                "query": "| makeresults\n| eval region=\"$myvars:result.region$\""
            },
            "type": "ds.search"
        }
    },
    "layout": {
        "globalInputs": [
            "input_mwKjgBTB"
        ],
        "layoutDefinitions": {
            "layout_1": {
                "options": {
                    "display": "auto",
                    "height": 960,
                    "width": 1440
                },
                "structure": [
                    {
                        "item": "viz_column_chart",
                        "position": {
                            "h": 250,
                            "w": 350,
                            "x": 370,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_2uQp06o5",
                        "position": {
                            "h": 100,
                            "w": 580,
                            "x": 1480,
                            "y": 70
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_JQgp3c9c",
                        "position": {
                            "h": 250,
                            "w": 350,
                            "x": 0,
                            "y": 0
                        },
                        "type": "block"
                    },
                    {
                        "item": "viz_bxuHwYLl",
                        "position": {
                            "h": 250,
                            "w": 350,
                            "x": 740,
                            "y": 0
                        },
                        "type": "block"
                    }
                ],
                "type": "absolute"
            }
        },
        "tabs": {
            "items": [
                {
                    "label": "New tab",
                    "layoutId": "layout_1"
                }
            ]
        }
    }
}

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will