Dashboards & Visualizations

Dropdown menu that swaps numerous tokens within a dashboard

yepyepyayyooo
New Member

I'm trying to consolidate my dashboards as the only difference between them are token values (same search criteria/logic). I am seeking guidance on how to construct the following:

A dropdown menu that will swap numerous tokens (in the various panels) based on the selected value in the dropdown menu. Example:

If the dropdown menu were to be "Hotel Selector" with the options:

Marriot
Holiday Inn
Four Seasons

Each option has it's own set of tokens (email address, email subject, hotel domain name, ip address). So if you were to select the first dropdown item (Marriot), the 4 tokens mentioned above will populate with the predefined values for that respective option (i.e. support@marriot.com, Marriot, marriot.com, 1.1.1.1) and refresh the panels with that option specific data. If however, you selection option 2 (Holiday Inn), the token values would swap and instead be support@holidayinn.com, Holiday Inn, holidayinn.com, 2.2.2.2, etc.

Hopefully I explained this okay. Appreciate any feedback. If there's a better way of going about this, I'm open to suggestions. Thanks in advanced.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@yepyepyayyooo ,

If you have static values in the hotel selector, you can set the tokens on change event of the drop down by using condition.
Here is a run anywhere example based on your data

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <change>
        <condition label="Marriot">
          <set token="email">support@marriot.com</set>
          <set token="subject">Marriot</set>
          <set token="domain">marriot.com</set>
          <set token="ip">1.1.1.1</set>
        </condition>
        <condition label="Holiday Inn">
          <set token="email">support@holidayinn.com</set>
          <set token="subject">Holiday Inn</set>
          <set token="domain">holidayinn.com</set>
          <set token="ip">2.2.2.2</set>
        </condition>
        <condition label="Four Seasons">
          <set token="email">support@fourseasons.com</set>
          <set token="subject">Four Seasons</set>
          <set token="domain">fourseasons.com</set>
          <set token="ip">4.4.4.4</set>
        </condition>
        <condition>
          <set token="email">support@yepyepyayyooo.com</set>
          <set token="subject">yepyepyayyooo</set>
          <set token="domain">yepyepyayyooo.com</set>
          <set token="ip">127.0.0.0</set>
        </condition>
      </change>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>

If you have dynamic values, then probably you need to run a search and set the tokens based on the search result fields.

E.g.

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row depends="$IamSupposedToBeHidddenAlways$">
    <panel>
      <table>
        <search >
          <query>index="myhosteldata" hotel_name="$hotel_selector$"|fields email,subject,domain,ip</query>
          <done>
            <set token="email">$result.email$</set>
            <set token="subject">$result.subject$</set>
            <set token="domain">$result.domain$</set>
            <set token="ip">$result.ip$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@yepyepyayyooo ,

If you have static values in the hotel selector, you can set the tokens on change event of the drop down by using condition.
Here is a run anywhere example based on your data

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <change>
        <condition label="Marriot">
          <set token="email">support@marriot.com</set>
          <set token="subject">Marriot</set>
          <set token="domain">marriot.com</set>
          <set token="ip">1.1.1.1</set>
        </condition>
        <condition label="Holiday Inn">
          <set token="email">support@holidayinn.com</set>
          <set token="subject">Holiday Inn</set>
          <set token="domain">holidayinn.com</set>
          <set token="ip">2.2.2.2</set>
        </condition>
        <condition label="Four Seasons">
          <set token="email">support@fourseasons.com</set>
          <set token="subject">Four Seasons</set>
          <set token="domain">fourseasons.com</set>
          <set token="ip">4.4.4.4</set>
        </condition>
        <condition>
          <set token="email">support@yepyepyayyooo.com</set>
          <set token="subject">yepyepyayyooo</set>
          <set token="domain">yepyepyayyooo.com</set>
          <set token="ip">127.0.0.0</set>
        </condition>
      </change>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>

If you have dynamic values, then probably you need to run a search and set the tokens based on the search result fields.

E.g.

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row depends="$IamSupposedToBeHidddenAlways$">
    <panel>
      <table>
        <search >
          <query>index="myhosteldata" hotel_name="$hotel_selector$"|fields email,subject,domain,ip</query>
          <done>
            <set token="email">$result.email$</set>
            <set token="subject">$result.subject$</set>
            <set token="domain">$result.domain$</set>
            <set token="ip">$result.ip$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

yepyepyayyooo
New Member

Thank you! Tremendously helpful. Exactly what I needed.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...