Dashboards & Visualizations

Dropdown menu that swaps numerous tokens within a dashboard

yepyepyayyooo
New Member

I'm trying to consolidate my dashboards as the only difference between them are token values (same search criteria/logic). I am seeking guidance on how to construct the following:

A dropdown menu that will swap numerous tokens (in the various panels) based on the selected value in the dropdown menu. Example:

If the dropdown menu were to be "Hotel Selector" with the options:

Marriot
Holiday Inn
Four Seasons

Each option has it's own set of tokens (email address, email subject, hotel domain name, ip address). So if you were to select the first dropdown item (Marriot), the 4 tokens mentioned above will populate with the predefined values for that respective option (i.e. support@marriot.com, Marriot, marriot.com, 1.1.1.1) and refresh the panels with that option specific data. If however, you selection option 2 (Holiday Inn), the token values would swap and instead be support@holidayinn.com, Holiday Inn, holidayinn.com, 2.2.2.2, etc.

Hopefully I explained this okay. Appreciate any feedback. If there's a better way of going about this, I'm open to suggestions. Thanks in advanced.

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@yepyepyayyooo ,

If you have static values in the hotel selector, you can set the tokens on change event of the drop down by using condition.
Here is a run anywhere example based on your data

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <change>
        <condition label="Marriot">
          <set token="email">support@marriot.com</set>
          <set token="subject">Marriot</set>
          <set token="domain">marriot.com</set>
          <set token="ip">1.1.1.1</set>
        </condition>
        <condition label="Holiday Inn">
          <set token="email">support@holidayinn.com</set>
          <set token="subject">Holiday Inn</set>
          <set token="domain">holidayinn.com</set>
          <set token="ip">2.2.2.2</set>
        </condition>
        <condition label="Four Seasons">
          <set token="email">support@fourseasons.com</set>
          <set token="subject">Four Seasons</set>
          <set token="domain">fourseasons.com</set>
          <set token="ip">4.4.4.4</set>
        </condition>
        <condition>
          <set token="email">support@yepyepyayyooo.com</set>
          <set token="subject">yepyepyayyooo</set>
          <set token="domain">yepyepyayyooo.com</set>
          <set token="ip">127.0.0.0</set>
        </condition>
      </change>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>

If you have dynamic values, then probably you need to run a search and set the tokens based on the search result fields.

E.g.

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row depends="$IamSupposedToBeHidddenAlways$">
    <panel>
      <table>
        <search >
          <query>index="myhosteldata" hotel_name="$hotel_selector$"|fields email,subject,domain,ip</query>
          <done>
            <set token="email">$result.email$</set>
            <set token="subject">$result.subject$</set>
            <set token="domain">$result.domain$</set>
            <set token="ip">$result.ip$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@yepyepyayyooo ,

If you have static values in the hotel selector, you can set the tokens on change event of the drop down by using condition.
Here is a run anywhere example based on your data

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <change>
        <condition label="Marriot">
          <set token="email">support@marriot.com</set>
          <set token="subject">Marriot</set>
          <set token="domain">marriot.com</set>
          <set token="ip">1.1.1.1</set>
        </condition>
        <condition label="Holiday Inn">
          <set token="email">support@holidayinn.com</set>
          <set token="subject">Holiday Inn</set>
          <set token="domain">holidayinn.com</set>
          <set token="ip">2.2.2.2</set>
        </condition>
        <condition label="Four Seasons">
          <set token="email">support@fourseasons.com</set>
          <set token="subject">Four Seasons</set>
          <set token="domain">fourseasons.com</set>
          <set token="ip">4.4.4.4</set>
        </condition>
        <condition>
          <set token="email">support@yepyepyayyooo.com</set>
          <set token="subject">yepyepyayyooo</set>
          <set token="domain">yepyepyayyooo.com</set>
          <set token="ip">127.0.0.0</set>
        </condition>
      </change>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>

If you have dynamic values, then probably you need to run a search and set the tokens based on the search result fields.

E.g.

<form>
  <label>Hotel Inventory</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="hotel_selector">
      <label>Hotel Selector</label>
      <choice value="Marriot">Marriot</choice>
      <choice value="Holiday Inn">Holiday Inn</choice>
      <choice value="Four Seasons">Four Seasons</choice>
      <default>Marriot</default>
      <initialValue>Marriot</initialValue>
    </input>
  </fieldset>
  <row depends="$IamSupposedToBeHidddenAlways$">
    <panel>
      <table>
        <search >
          <query>index="myhosteldata" hotel_name="$hotel_selector$"|fields email,subject,domain,ip</query>
          <done>
            <set token="email">$result.email$</set>
            <set token="subject">$result.subject$</set>
            <set token="domain">$result.domain$</set>
            <set token="ip">$result.ip$</set>
          </done>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <html>
      <h1>Hotel Selected : $hotel_selector$</h1>
      <h2>Email : $email$</h2>
      <h2>Subject : $subject$</h2>
      <h2>Domain : $domain$</h2>
      <h2>IP Address : $ip$</h2>
    </html>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

yepyepyayyooo
New Member

Thank you! Tremendously helpful. Exactly what I needed.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...