Dashboards & Visualizations
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Filter Not get updated with correct Value

shugup2923
Path Finder
‎08-09-2019 03:12 AM

I have two filter in Dashboard, In which I am using token of one filter in search of other filter, search is returning the desired result but the previous result of the search is not going away, I need to click dropdown and then select the value.

ACtually I am using the second filter value at different places in dashbaord which is not getting reflected as its not changing in filter.

Anyone who can assist ?

0 Karma
Reply

woodcock
Esteemed Legend
‎11-10-2019 03:23 PM

You need to use way more words here; your description is way too vague. In general, though, you can usually find an example of these kinds of things in the Dashboards Examples app on Splunkbase; install it and poke around until you find something that you can clone:
https://splunkbase.splunk.com/app/1603/

0 Karma
Reply

nareshinsvu
Builder
‎08-12-2019 07:47 PM

Can you try this code? Kindly Accept and upvote if it helped. Hope it works for you 🙂

<form>
  <label>Dropdown demo</label>
  <fieldset autoRun="false" submitButton="false">
    <input type="dropdown" token="selected_option" searchWhenChanged="true">
      <label>Select an option</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
      <fieldForLabel>Source</fieldForLabel>
      <fieldForValue>Source</fieldForValue>
      <search>
        <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
        <earliest>0</earliest>
      </search>
       <change>
         <condition match="$selected_option$=&quot;One&quot;">
           <unset token="form.selected_field"></unset>
           <set token="token_field">"APAC- Engine"</set>
           <set token="generic">1</set>
         </condition>
         <condition match="$selected_option$=&quot;Two&quot;">
           <unset token="form.selected_field"></unset>
           <set token="token_field">"EMEA 1 - IDF"</set>
           <set token="generic">1</set>
         </condition> </change></input>
<input type="dropdown" token="selected_field" searchWhenChanged="true" >
   <label>Select field</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
    <fieldForLabel>abc</fieldForLabel>
   <fieldForValue>abc</fieldForValue>
   <search>
     <query>|makeresults|eval abc=$token_field$</query>
        <earliest>0</earliest>
      </search>
       <change>
         <condition match="$value$=&quot;APAC- Engine&quot; AND $selected_option$=&quot;One&quot;">
           <set token="selected_T_query">|makeresults |eval Message="My 1st selected option -   $selected_option$ has field  $selected_field$ "| table Message</set>
           <unset token="generic"></unset>
         </condition>
         <condition match="$value$=&quot;EMEA 1 - IDF&quot; AND $selected_option$=&quot;Two&quot;">
           <set token="selected_T_query">|makeresults |eval Message="My 2nd selected option -   $selected_option$ has field  $selected_field$ " | table Message</set>
           <unset token="generic"></unset>
         </condition>
       </change>
    </input>
 </fieldset>
 <row>
    <panel rejects="$generic$">
      <title>$selected_option$  on $selected_field$ </title>
      <table>
        <search>
          <query> $selected_T_query$ </query>
          <earliest>-7d@d</earliest>
          <sampleRatio>1</sampleRatio>
       </search>
    </table>
       </panel>
  </row>
</form>
0 Karma
Reply

nareshinsvu
Builder
‎08-19-2019 09:19 PM

Kindly Accept and/or upvote if it helped. It might help other splunkers with similar issues.

0 Karma
Reply

shugup2923
Path Finder
‎08-12-2019 01:09 AM

Dropdown demo

<input type="dropdown" token="selected_option" searchWhenChanged="true">
  <label>Select an option</label>
  <default>-</default>
  <choice value="-"></choice>
  <initialValue>-</initialValue>
  <fieldForLabel>Source</fieldForLabel>
  <fieldForValue>Source</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
    <earliest>0</earliest>
  </search>
</input>
<input type="dropdown" token="field1">
  <label>field1</label>
  <fieldForLabel>abc</fieldForLabel>
  <fieldForValue>abc</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"]

|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
-24h@h
now

<panel>
  <title>$field1$</title>
  <table>
    <search>
      <query> $selected_T_query$ </query>
      <earliest>-7d@d</earliest>
      <sampleRatio>1</sampleRatio>
    </search>
  </table>
</panel>
0 Karma
Reply

shugup2923
Path Finder
‎08-12-2019 01:01 AM

I tried to modified your queries in such way that now you can understand my requirement-
Please consider below points-
1.When you select a option from first filter i.e, One or Two.
2.Value gets changed in field1 filter.
3.But the latest value do not get reflected in below panel where I have give $field1$ token.

When I select One in "select an option" value in field1 should be APAC
and when I select Two value should be EMEA, But its not getting reflected in below panel. It only gets changed when I Manually selects the value from second input i.e field1.

Dropdown demo

<input type="dropdown" token="selected_option" searchWhenChanged="true">
  <label>Select an option</label>
  <default>-</default>
  <choice value="-"></choice>
  <initialValue>-</initialValue>
  <fieldForLabel>Source</fieldForLabel>
  <fieldForValue>Source</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
    <earliest>0</earliest>
  </search>
</input>
<input type="dropdown" token="field1">
  <label>field1</label>
  <fieldForLabel>abc</fieldForLabel>
  <fieldForValue>abc</fieldForValue>
  <search>
    <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"]

|search Source=$selected_option$
|eval abc=case(Source=="One", "APAC- Engine ", Source=="Two", "EMEA 1 - IDF")
|table abc
-24h@h
now

<panel>
  <title>$field1$</title>
  <table>
    <search>
      <query> $selected_T_query$ </query>
      <earliest>-7d@d</earliest>
      <sampleRatio>1</sampleRatio>
    </search>
  </table>
</panel>
0 Karma
Reply

nareshinsvu
Builder
‎08-11-2019 10:42 PM

How are you dealing with tokens? Are they being referenced as $token$. Below is a small sample reference code with 2 drop-downs if you can relate to yours.
Can you share your code snippet to troubleshoot further?

<form>
  <label>Dropdown demo</label>
  <fieldset autoRun="false" submitButton="false">   
    <input type="dropdown" token="selected_option" searchWhenChanged="true">
      <label>Select an option</label>
      <default>-</default>
      <choice value="-"></choice>
      <initialValue>-</initialValue>
      <fieldForLabel>Source</fieldForLabel>
      <fieldForValue>Source</fieldForValue>
      <search>
        <query>| makeresults | eval Source="One" | append [ | makeresults | eval Source="Two"] | table Source </query>
        <earliest>0</earliest>
      </search>
</input>
    <input type="dropdown" token="selected_date" searchWhenChanged="true">
      <label>Select a Date</label>
      <default></default>
      <choice value="-"></choice>
      <initialValue></initialValue>
      <fieldForLabel>Dates</fieldForLabel>
      <fieldForValue>Dates</fieldForValue>
      <search>
        <query>| gentimes start=-7  |  eval Dates=strftime(starttime,"%Y-%m-%d") |table Dates</query>
         <earliest>-8d@d</earliest>
        <latest>@d</latest>
      </search>
      <change>
        <condition match="$selected_option$=&quot;One&quot;">
          <set token="selected_T_query">index=my_index  |search Day=$selected_date$ Type=$selected_option$</set>
        </condition>
        <condition match="$selected_option$=&quot;Two&quot;">
          <set token="selected_T_query">index=my_other_index  |search Day=$selected_date$ Type=$selected_option$</set>
        </condition>
      </change>
    </input>
 </fieldset>
 <row>
    <panel>
      <title>$selected_option$  on Date - $selected_date$ </title>
      <table>
        <search>
          <query> $selected_T_query$ </query>
          <earliest>-7d@d</earliest>
          <sampleRatio>1</sampleRatio>
       </search>
      </table>
       </panel>
  </row>   
</form>
0 Karma
Reply
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...