Have a look at the example below, I have included the dashboard config further down.
I am using the original cluster dropdown value with a query (called myvar) displayed as a table (hidden out of view) and then using $myvar:result.<field>$ where we need to use the value.
{
"title": "Answers - testing",
"description": "",
"inputs": {
"input_mwKjgBTB": {
"options": {
"items": [
{
"label": "useast01",
"value": "useast01"
},
{
"label": "uswest01",
"value": "uswest01"
},
{
"label": "usqaf01",
"value": "usqaf01"
}
],
"selectFirstSearchResult": true,
"token": "cluster"
},
"title": "Cluster",
"type": "input.dropdown"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
}
},
"visualizations": {
"viz_2uQp06o5": {
"dataSources": {
"primary": "ds_c8AfQapt"
},
"type": "splunk.table"
},
"viz_JQgp3c9c": {
"containerOptions": {},
"dataSources": {
"primary": "ds_eGOCKAoM_ds_qBGlESX2"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "name",
"token": "method"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"majorValue": "> sparklineValues | lastPoint()",
"trendValue": "> sparklineValues | delta(-2)"
},
"showLastUpdated": false,
"showProgressBar": false,
"title": "Cluster",
"type": "splunk.singlevalue"
},
"viz_bxuHwYLl": {
"containerOptions": {},
"dataSources": {
"primary": "ds_FKvGrvZ4_ds_qBGlESX2"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "name",
"token": "method"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"majorValue": "> sparklineValues | lastPoint()",
"trendValue": "> sparklineValues | delta(-2)"
},
"showLastUpdated": false,
"showProgressBar": false,
"title": "Space",
"type": "splunk.singlevalue"
},
"viz_column_chart": {
"containerOptions": {},
"dataSources": {
"primary": "ds_qBGlESX2"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "name",
"token": "method"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"majorValue": "> sparklineValues | lastPoint()",
"trendValue": "> sparklineValues | delta(-2)"
},
"showLastUpdated": false,
"showProgressBar": false,
"title": "Region",
"type": "splunk.singlevalue"
}
},
"dataSources": {
"ds_FKvGrvZ4_ds_qBGlESX2": {
"name": "get_space",
"options": {
"enableSmartSources": true,
"query": "| makeresults\n| eval space=\"$myvars:result.space$\""
},
"type": "ds.search"
},
"ds_c8AfQapt": {
"name": "myvars",
"options": {
"enableSmartSources": true,
"query": "| makeresults\n| eval cluster=\"$cluster$\"\n| eval space=CASE(cluster==\"usqaf01\", \"abs-qff\", cluster==\"uswest01\",\"abs-qpp1\",cluster==\"useast01\",\"abs-qpp1\")\n| eval region=CASE(cluster==\"usqaf01\", \"QAF\", cluster==\"uswest01\",\"QAWEST\",cluster==\"useast01\",\"QAEAST\")",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"type": "ds.search"
},
"ds_eGOCKAoM_ds_qBGlESX2": {
"name": "get_cluster",
"options": {
"enableSmartSources": true,
"query": "| makeresults\n| eval cluster=\"$myvars:result.cluster$\""
},
"type": "ds.search"
},
"ds_qBGlESX2": {
"name": "Search_1",
"options": {
"enableSmartSources": true,
"query": "| makeresults\n| eval region=\"$myvars:result.region$\""
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_mwKjgBTB"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_column_chart",
"position": {
"h": 250,
"w": 350,
"x": 370,
"y": 0
},
"type": "block"
},
{
"item": "viz_2uQp06o5",
"position": {
"h": 100,
"w": 580,
"x": 1480,
"y": 70
},
"type": "block"
},
{
"item": "viz_JQgp3c9c",
"position": {
"h": 250,
"w": 350,
"x": 0,
"y": 0
},
"type": "block"
},
{
"item": "viz_bxuHwYLl",
"position": {
"h": 250,
"w": 350,
"x": 740,
"y": 0
},
"type": "block"
}
],
"type": "absolute"
}
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
}
}
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
