Dashboards & Visualizations

Dynamic Table Filtering with Varying Field Names

mattfunk20
Explorer

Hi all! 
I've populated a table dynamically based on a drop down a user can manipulate using... 

 

| inputlookup 
    [| rest /services/saved/searches 
    | fields title 
    | search title=*$userInput$*.c 
    | eval check=replace(title,"\.c",".csv") 
    | return $check] 

 

Additionally I can extrapolate each column into a dropdown using...

 

| inputlookup 
    [| rest /services/saved/searches 
    | fields title 
    | search title=*$userInput$*.c 
    | eval check=replace(title,"\.c",".csv") 
    | return $check] 
| eval value= 
    [| inputlookup 
        [| rest /services/saved/searches 
        | fields title 
        | search title=*$userInput$*.c 
        | eval check=replace(title,"\.c",".csv") 
        | return $check] 
    | transpose 
    | fields column 
    | streamstats count(column) as order 
    | where order = 2 
    | return $column] 
| fields value 
| table value 
| stats values(value) as value 
| mvexpand value

 

by varying order = # 

The issue I'm running into now is pairing the drop down,  the drop down with a set token of "filter1"
Run within 

 

| inputlookup 
    [| rest /services/saved/searches 
    | fields title 
    | search title=*$userInput$*.c 
    | eval check=replace(title,"\.c",".csv") 
    | return $check] 
| search
    [| inputlookup 
        [| rest /services/saved/searches 
        | fields title 
        | search title=*$userInput$*.c 
        | eval check=replace(title,"\.c",".csv") 
        | return $check] 
    | head 1 
    | table * 
    | transpose 
    | head 1 
    | return $column] = $filter1$

 

 

The token is not functioning and will not populate in the query, while other tokens will. I've additionally confirmed the query works, just not when used with tokens within a dashboard. 

To summarize, the overall goal is to provide 4-6 drop downs and a table. Based on the initial user request, this table would populate with data, and each drop down would then be able to further filter data,  with the field names and values all varying.

If something isn't clear please ask and I'd be glad to provide, been banging my head against this one for awhile lol.

Labels (2)
0 Karma
1 Solution

mattfunk20
Explorer

I was able to resolve this via hidden searches within a dashboard. 
I tokenized the lookup table based on a user dropdown, which then ran ~5 searches based on that, returning the tokenized objects I needed.

View solution in original post

0 Karma

mattfunk20
Explorer

I was able to resolve this via hidden searches within a dashboard. 
I tokenized the lookup table based on a user dropdown, which then ran ~5 searches based on that, returning the tokenized objects I needed.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried using token modifiers?

| return $column] = $filter1|s$
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...